PT-2023-4676 · Unknown · Mxsecurity

Darren Martyn · Publicado 2023-08-08 · Atualizado 2024-10-28 · CVE-2023-39982

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MXsecurity versions prior to v1.0.1

Description The issue is related to the use of a hard-coded SSH host key in the MXsecurity platform, which may facilitate man-in-the-middle attacks and enable the decryption of SSH traffic. This could put the confidentiality and integrity of SSH communications at risk on the affected device.

Recommendations For MXsecurity versions prior to v1.0.1, update to version v1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting SSH access to minimize the risk of exploitation. Avoid using the hard-coded SSH host key in the affected device until the issue is resolved.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-321

Identificadores relacionados

BDU:2023-05089

CVE-2023-39982

Produtos afetados

Mxsecurity

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-39982 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39982 · Aviso do Fabricante
• https://vuldb.com/ru/?id.238621 · Nota
• https://twitter.com/cracbot/status/1698214279378559278 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1697954564065075567 · Publicação no Twitter
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1697984985142067372 · Publicação no Twitter
• https://twitter.com/NUYTSTECH/status/1704446829461651688 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-05089 · Nota de Segurança
• https://t.me/cvenotify/99696 · Publicação no Telegram