Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Command-injection Vulnerability in Certificate Management (Moxa TN-5900 Series)

CVE-2023-33238
HIGH 7.2

En bref

Source
NVD
EPSS
EPSS 0.82 % · centile 57 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Moxa
Statut NVD
Modified

Rechercher sur…

Description

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

Faiblesses (CWE)

  • CWE-78 — Injection de commande système
  • CWE-77 — Injection de commande

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HMoxa
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · psirt@moxa.com (Secondary)
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Moxa · TN-5900 Seriesaffected 1.0 ≤ 3.3
Moxa · TN-4900 Seriesaffected 1.0 ≤ 1.2.4
Moxa · EDR-810 Seriesaffected 1.0 ≤ 5.12.27
Moxa · EDR-G902 Seriesaffected 1.0 ≤ 5.7.17
Moxa · EDR-G903 Seriesaffected 1.0 ≤ 5.7.15
Moxa · EDR-G9010 Seriesaffected 1.0 ≤ 2.1
Moxa · NAT-102 Seriesaffected 1.0 ≤ 1.0.3

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD