Vulnerability · Published Dec 23, 2023 · Assigned by Moxa

CVE-2023-5961ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability

High 8.8

In plain English

A high-severity cross-site request forgery in ioLogik E1200 Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 68.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.

Affected products (as reported)

Vendor	Product	Versions
Moxa	ioLogik E1200 Series	1.0 – through 3.3

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability vendor-advisory