CVE-2021-39280: Korenix Jetwave 2212g Firmware

High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9.1, 2212G before 1.8, 3220 V3 before 1.5.1, 3420 V3 before 1.5.1, and 2311 through 2022-01-31.

Affected products

• Korenix Jetwave 2212g Firmware: before 1.8 (fixed in 1.8)
• Korenix Jetwave 2212s Firmware: before 1.9.1 (fixed in 1.9.1)
• Korenix Jetwave 2212x Firmware: before 1.9.1 (fixed in 1.9.1)
• Korenix Jetwave 2311 Firmware: up to and including 1.2
• Korenix Jetwave 3220 Firmware: before 1.5.1 (fixed in 1.5.1)
• Korenix Jetwave 3420 Firmware: before 1.5.1 (fixed in 1.5.1)

Published 2022-02-06. Last modified 2026-06-17.