PT-2023-4557 · Moxa · Iologik 4000 Series

Published 2023-08-24 · Updated 2024-10-28 · CVE-2023-4227

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ioLogik 4000 Series (ioLogik E4200) versions v1.6 and prior

Description A vulnerability has been identified that can be exploited by malicious actors to potentially gain unauthorized access to the product, leading to security breaches, data theft, and unauthorized manipulation of sensitive information. The issue is attributed to inadequate access control and the presence of an unauthorized service, which could enable unauthorized access to the device.

Recommendations For ioLogik 4000 Series (ioLogik E4200) versions v1.6 and prior, consider disabling any unauthorized services until a patch is available to prevent potential exploitation. Restrict access to sensitive information and ensure proper access controls are in place to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-489

CWE-863

Related Identifiers

BDU:2023-04963

CVE-2023-4227

Affected Products

Iologik 4000 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-4227 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04963 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4227 · Vendor Advisory
• https://vuldb.com/ru/?id.237900 · Note