Command-injection Vulnerability in Certificate Management (Moxa TN-5900 Series)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.82 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Moxa
- NVD status
- Modified
Description
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Moxa |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@moxa.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-37407
- GCVE · GCVE-0-2023-33238
CERT-FR advisories
- CERTFR-2023-AVI-0659 — Multiples vulnérabilités dans les produits Moxa · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:moxa:tn-5900_firmware:*:*:*:*:*:*:*:*≤ 3.3cpe:2.3:o:moxa:tn-4900_firmware:*:*:*:*:*:*:*:*≤ 1.2.4
Affected products
| Product | Versions |
|---|---|
| Moxa · TN-5900 Series | affected 1.0 ≤ 3.3 |
| Moxa · TN-4900 Series | affected 1.0 ≤ 1.2.4 |
| Moxa · EDR-810 Series | affected 1.0 ≤ 5.12.27 |
| Moxa · EDR-G902 Series | affected 1.0 ≤ 5.7.17 |
| Moxa · EDR-G903 Series | affected 1.0 ≤ 5.7.15 |
| Moxa · EDR-G9010 Series | affected 1.0 ≤ 2.1 |
| Moxa · NAT-102 Series | affected 1.0 ≤ 1.0.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |