PT-2023-6853 · Moxa · Moxa Pt-G503 Series

Published 2023-09-18 · Updated 2023-11-09 · CVE-2023-5035

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moxa PT-G503 Series firmware versions prior to v5.2

Description The issue is related to the absence of the secure flag in session cookies, which could allow a remote attacker to gain unauthorized access to protected information. This may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.

Recommendations For Moxa PT-G503 Series firmware versions prior to v5.2, update to version v5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive cookies in HTTPS sessions to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-319

CWE-614

CWE-668

CWE-1004

Related Identifiers

BDU:2023-07862

CVE-2023-5035

Affected Products

Moxa Pt-G503 Series

References · 10

• https://bdu.fstec.ru/vul/2023-07862 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5035 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5035 · Vendor Advisory
• https://twitter.com/CVEnew/status/1720119251464265778 · Twitter Post
• https://t.me/cvenotify/60403 · Telegram Post
• https://t.me/cvenotify/60387 · Telegram Post
• https://t.me/cibsecurity/73462 · Telegram Post
• https://vuldb.com/ru/?id.244374 · Note
• https://twitter.com/VulmonFeeds/status/1720146595402977610 · Twitter Post