PT-2023-4675 · Unknown · Mxsecurity

James Sebree · Published 2023-08-08 · Updated 2023-09-19 · CVE-2023-39983

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MXsecurity versions prior to v1.0.1

Description A vulnerability has been identified that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI. This issue might allow an unauthenticated remote attacker to register or add devices via the nsm-web application. The vulnerability is related to insufficient control of modification of dynamically defined object characteristics.

Recommendations For MXsecurity versions prior to v1.0.1, update to version v1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the nsm-web application to minimize the risk of exploitation. Avoid using the nsm-web UI to register or add devices until the issue is resolved.

Fix

Weakness Enumeration

CWE-913

CWE-915

Related Identifiers

BDU:2023-05088

CVE-2023-39983

Affected Products

Mxsecurity

References · 8

• https://osv.dev/vulnerability/CVE-2023-39983 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05088 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39983 · Security Note
• https://twitter.com/CVEnew/status/1697954562530062360 · Twitter Post
• https://vuldb.com/?id.238620 · Note
• https://twitter.com/VulmonFeeds/status/1697985238553464901 · Twitter Post
• https://twitter.com/NUYTSTECH/status/1704085941743419720 · Twitter Post