PT-2023-4556 · Moxa · Iologik 4000 Series

Published 2023-08-24 · Updated 2023-09-01 · CVE-2023-4230

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ioLogik 4000 Series (ioLogik E4200) versions v1.6 and prior

Description A vulnerability has been identified that may facilitate the collection of information on ioLogik 4000 Series devices, potentially enabling attackers to gather information for assessing vulnerabilities and attack vectors. The issue is related to the lack of protection for service data in the ioLogik web server, which could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For ioLogik 4000 Series (ioLogik E4200) versions v1.6 and prior, update the firmware to a version later than v1.6 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-668

CWE-200

Related Identifiers

BDU:2023-04962

CVE-2023-4230

Affected Products

Iologik 4000 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-4230 · Security Note
• https://bdu.fstec.ru/vul/2023-04962 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4230 · Vendor Advisory
• https://vuldb.com/ru/?id.237904 · Note