Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Second Order Command-injection Vulnerability in the Certificate-delete Function (Moxa TN-5900 Series)

CVE-2023-34217
HIGH 8.1

En bref

Source
NVD
EPSS
EPSS 0.45 % · centile 39 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Moxa
Statut NVD
Modified

Rechercher sur…

Description

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.

Faiblesses (CWE)

  • CWE-22 — Traversée de répertoire

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HMoxa
CVSS 3.1HIGH 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HNVD · psirt@moxa.com (Secondary)
CVSS 3.1HIGH 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Moxa · TN-5900 Seriesaffected 1.0 ≤ 3.3
Moxa · TN-4900 Seriesaffected 1.0 ≤ 1.2.4
Moxa · EDR-G902 Seriesaffected 1.0 ≤ 5.7.17
Moxa · EDR-G903 Seriesaffected 1.0 ≤ 5.7.15
Moxa · EDR-G9010 Seriesaffected 1.0 ≤ 2.1
Moxa · NAT-102 Seriesaffected 1.0 ≤ 1.0.3

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD