PT-2023-1864 · Moxa · Moxa Uc Series

Casper Bladt · Published 2023-02-23 · Updated 2023-03-14 · CVE-2023-1257

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa UC Series devices (affected versions not specified)

Description The issue allows an attacker with physical access to the device to initiate a restart, gain access to the BIOS, and alter command line options to access the terminal. From the terminal, the attacker can modify authentication files to create a new user and gain full access to the system. The vulnerability is related to insufficient access control on Moxa UC Series devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1263

Related Identifiers

BDU:2023-01463

CVE-2023-1257

Affected Products

Moxa Uc Series

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-1257 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1257 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01463 · Security Note
• https://vuldb.com/?id.222553 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-333-04 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-333-04 · Note
• https://t.me/cibsecurity/59608 · Telegram Post