CVE-2023-33238

Command-injection Vulnerability in Certificate Management

State: Published
Severity: 7.2 High
Published: Aug 17, 2023
Updated: Oct 28, 2024
Reserved: May 19, 2023

Description

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Moxa

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
TN-5900 SeriesMoxa	1.0 through 3.3Affected
TN-4900 SeriesMoxa	1.0 through 1.2.4Affected
EDR-810 SeriesMoxa	1.0 through 5.12.27Affected
EDR-G902 SeriesMoxa	1.0 through 5.7.17Affected
EDR-G903 SeriesMoxa	1.0 through 5.7.15Affected
EDR-G9010 SeriesMoxa	1.0 through 2.1Affected
NAT-102 SeriesMoxa	1.0 through 1.0.3Affected

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilitiesvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.