PT-2023-4619 · Moxa · Moxa Tn-4900 Series+1

Published 2023-08-16 · Updated 2024-10-28 · CVE-2023-33238

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa TN-4900 Series firmware versions v1.2.4 and prior Moxa TN-5900 Series firmware versions v3.3 and prior

Description The issue stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices. This is related to errors in processing input data, potentially enabling a remote attacker to execute arbitrary code.

Recommendations For Moxa TN-4900 Series firmware versions v1.2.4 and prior, update to a version later than v1.2.4 to resolve the issue. For Moxa TN-5900 Series firmware versions v3.3 and prior, update to a version later than v3.3 to resolve the issue. As a temporary workaround, consider restricting access to the certificate management function until a patch is available.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2023-05026

CVE-2023-33238

Affected Products

Moxa Tn-4900 Series

Moxa Tn-5900 Series

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-33238 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33238 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05026 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1692050627268882432 · Twitter Post
• https://twitter.com/CVEnew/status/1692000072807088443 · Twitter Post
• https://t.me/cvenotify/99691 · Telegram Post
• https://twitter.com/cracbot/status/1692416098115911695 · Twitter Post