Lucene search

K
cvelistMoxaCVELIST:CVE-2023-33238
HistoryAug 17, 2023 - 2:04 a.m.

CVE-2023-33238 Command-injection Vulnerability in Certificate Management

2023-08-1702:04:50
CWE-77
Moxa
www.cve.org
1
cve-2023-33238
command-injection
certificate management
tn-4900 series
tn-5900 series
firmware
remote code

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.001

Percentile

35.1%

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "TN-5900 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "3.3",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TN-4900 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "1.2.4",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-810 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "5.12.27",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G902 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "5.7.17",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G903 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "5.7.15",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G9010 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "2.1",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NAT-102 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "1.0.3",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.001

Percentile

35.1%

Related for CVELIST:CVE-2023-33238