CVE-2023-33238
Command-injection Vulnerability in Certificate Management
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Moxa TN-5900 Series
From 1.0 · through 3.3
- Moxa TN-4900 Series
From 1.0 · through 1.2.4
- Moxa EDR-810 Series
From 1.0 · through 5.12.27
- Moxa EDR-G902 Series
From 1.0 · through 5.7.17
- Moxa EDR-G903 Series
From 1.0 · through 5.7.15
- Moxa EDR-G9010 Series
From 1.0 · through 2.1
- Moxa NAT-102 Series
From 1.0 · through 1.0.3