Vulnerability · Published Aug 17, 2023 · Assigned by Moxa
CVE-2023-33238Command-injection Vulnerability in Certificate Management
High 7.2
In plain English
A high-severity OS command injection in EDR-810 Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moxa | TN-5900 Series | 1.0 – through 3.3 |
| Moxa | TN-4900 Series | 1.0 – through 1.2.4 |
| Moxa | EDR-810 Series | 1.0 – through 5.12.27 |
| Moxa | EDR-G902 Series | 1.0 – through 5.7.17 |
| Moxa | EDR-G903 Series | 1.0 – through 5.7.15 |
| Moxa | EDR-G9010 Series | 1.0 – through 2.1 |
| Moxa | NAT-102 Series | 1.0 – through 1.0.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H