Lucene search

K
cvelistMoxaCVELIST:CVE-2023-34217
HistoryAug 17, 2023 - 6:48 a.m.

CVE-2023-34217 Second Order Command-injection Vulnerability in the Certificate-delete Function

2023-08-1706:48:38
CWE-22
Moxa
www.cve.org
4
cve-2023-34217
command-injection
tn-4900
tn-5900
firmware
input validation

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

33.0%

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "TN-5900 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "3.3",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TN-4900 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "1.2.4",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G902 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "5.7.17",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G903 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "5.7.15",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EDR-G9010 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "2.1",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NAT-102 Series",
    "vendor": "Moxa",
    "versions": [
      {
        "lessThanOrEqual": "1.0.3",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

33.0%

Related for CVELIST:CVE-2023-34217