by Kastro
Paper/Archive/CVE-2023-33238

CVE-2023-33238

Moxa TN-5900 Series — Command-injection Vulnerability in Certificate Management

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

Affected

ProductAffectedFixed inSource
TN-5900 Series1.0 – 3.3–CNA
TN-4900 Series1.0 – 1.2.4–CNA
EDR-810 Series1.0 – 5.12.27–CNA
EDR-G902 Series1.0 – 5.7.17–CNA
EDR-G903 Series1.0 – 5.7.15–CNA
EDR-G9010 Series1.0 – 2.1–CNA
NAT-102 Series1.0 – 1.0.3–CNA
tn-59001.0 – 3.3–CISA-ADP
tn-49001.0 – 1.2.4–CISA-ADP
edr-8101.0 – 5.12.27–CISA-ADP
edr-g9021.0 – 5.7.17–CISA-ADP
edr-g90101.0 – 2.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Moxa (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymoxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities