CVE-2023-5347 is a critical (CVSS 9.8) improper signature verification flaw in the update process of Korenix JetNet industrial switches. It allows replacing the whole operating system, including trusted executables. The record lists devices older than firmware 2024/01 as affected, so update, or apply the vendor workaround.
What's affected
The NVD record says an improper verification of a cryptographic signature in the update process of Korenix JetNet series devices allows replacing the whole operating system, including trusted executables. It affects JetNet devices older than firmware version 2024/01.
CyberDanube, which reported the issue, published its advisory on 9 January 2024 together with CVE-2023-5376, a sibling issue in the TFTP service. It describes an unauthenticated firmware upgrade that leads to remote code execution, and lists affected models including the JetNet 4508, 4508f, 5620G-4C, 5612GP-4F, 5612G-4F, 5728G and 528Gf families with their versions.
There is a difference between sources on the fix. The record points to firmware 2024/01. The CyberDanube advisory says Beijer, the parent company of Korenix, provided a workaround until a proper patch was available. The Beijer support page could not be read automatically, so check it for the current firmware for your model.
How to check if you're exposed
Find the firmware version for each JetNet switch in its web interface or by command line, and compare it with the models and versions in the CyberDanube advisory and the Beijer notice.
Check whether the TFTP service is running. The vendor workaround turns off two services, so you can see whether it is already applied in the running configuration.
show running-config
Then look at network exposure. Industrial switches should not be reachable from the internet or from general office networks, and management access should be limited to a small administration network.
What to do now
- List all Korenix JetNet switches with model and firmware version.
- Install firmware 2024/01 or later when Beijer provides it for your model.
- Until then, apply the vendor workaround from the Beijer advisory, which disables the IP scan service and the TFTP daemon and saves the configuration.
- Limit management access to a dedicated network and block it from the internet.
- Monitor for unexpected reboots or configuration changes on the switches.
Why it matters
The record lists CWE-327, CWE-347: use of a weak cryptographic algorithm and improper verification of a cryptographic signature. An update mechanism that does not verify who produced the image will install whatever it is given, including a modified operating system.
That is the worst outcome on a network device, because a switch sits in the path of traffic. The attacker controls the device below any security tool you run on it. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Signed updates only help if the signature check actually works.
Quick check
What is the workaround?
CyberDanube quotes Beijer: disable the IP scan service and the TFTP daemon from the terminal, then save the configuration. Read the Beijer notice for the current guidance.
Sources
Last reviewed: 19 October 2026.
