CVE-2023-5376 is a high severity (CVSS 8.6) improper authentication flaw in the TFTP service of Korenix JetNet industrial switches. It affects devices older than firmware version 2024/01. Update to that firmware or later, or apply the vendor workaround that disables the TFTP daemon.
What's affected
The NVD record says an improper authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. It affects JetNet devices older than firmware version 2024/01.
CyberDanube published the advisory on 9 January 2024 together with CVE-2023-5347, the firmware signature flaw. It describes the combination as an unauthenticated firmware upgrade leading to remote code execution. It was tested on an emulated JetNet 5310G, and the vendor lists several JetNet 4508, 5612, 5620 and 5728 model families as vulnerable.
As with the sibling issue, sources differ on the fix. The record points to firmware 2024/01, while CyberDanube says Beijer supplied a workaround until a proper patch existed. Check the Beijer notice for the current firmware for your model.
How to check if you're exposed
Check the firmware version in each switch interface and compare it with the CyberDanube list.
Check whether TFTP is enabled. The workaround from the vendor turns off the TFTP daemon, so the running configuration shows if it is on.
show running-config
Scan your own management network for devices that answer on the TFTP port, because those are the ones that offer the service to anyone who can reach them.
What to do now
- Inventory JetNet switches and firmware versions.
- Install firmware 2024/01 or later when available for your model.
- Apply the vendor workaround now: disable the TFTP daemon and the IP scan service, then save the configuration.
- Block the TFTP port at network boundaries and between segments.
- Treat both Korenix CVEs together, since they chain into a firmware replacement.
Why it matters
The record lists CWE-306, CWE-287: missing authentication for a critical function and improper authentication. The TFTP service accepts file transfers from anyone, and TFTP has no login in the protocol at all, so the device must decide who may use it.
On its own an open file service is a problem. Combined with weak signature checks it becomes a path to replacing the device software. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Disable legacy services you do not use on any network device.
Quick check
Does turning off TFTP break anything?
It stops TFTP based transfers to and from the switch. Check which tools or processes you use for backups and updates before you change it.
Sources
Last reviewed: 19 October 2026.
