PT-2023-4389 · Moxa · Moxa Tn-5900 Series

CVE-2023-33237 · Publicado 2023-08-16 · Atualizado 2024-10-28

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa TN-5900 Series firmware version v3.3 and prior

Description The issue is related to improper authentication in the web API handler of the Moxa TN-5900 Series firmware, allowing low-privileged APIs to execute restricted actions. This presents a potential risk of unauthorized exploitation by malicious actors. The vulnerability arises from inadequate authentication measures implemented in the web API handler.

Recommendations For Moxa TN-5900 Series firmware version v3.3 and prior, consider restricting access to the web API handler until a patch is available. As a temporary workaround, limit the execution of restricted actions to only high-privileged APIs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Authentication

Enumeração de Fraquezas

CWE-863

CWE-287

Identificadores relacionados

BDU:2023-04734

CVE-2023-33237

Produtos afetados

Moxa Tn-5900 Series

Referências · 9

• https://moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1691995722496004216 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1692050880252588528 · Publicação no Twitter
• https://t.me/cvenotify/99690 · Publicação no Telegram
• https://twitter.com/cracbot/status/1692416096639623192 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-33237 · Nota de Segurança
• https://t.me/cvenotify/56713 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33237 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04734 · Nota de Segurança