CVE-2023-33237: Authentication Bypass Without Administrator Privilege

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-33237.

Q: What is the severity of CVE-2023-33237?

The severity of CVE-2023-33237 is high with a severity value of 8.8.

Q: What software versions are affected by CVE-2023-33237?

TN-5900 Series firmware version v3.3 and prior are affected by CVE-2023-33237.

Q: How does CVE-2023-33237 occur?

CVE-2023-33237 occurs due to inadequate authentication measures implemented in the web API handler of TN-5900 Series firmware version v3.3 and prior.

Q: Is there a fix available for CVE-2023-33237?

Please refer to the Moxa Security Advisory for remediation steps and firmware updates for CVE-2023-33237.

Published Aug 17, 2023

Updated

TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted actions that only high-privileged APIs are allowed This presents a potential risk of unauthorized exploitation by malicious actors.

Affected Software

4 affected components

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

All of the following

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

Remediation

Patch Available

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities

Information

Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below: * TN-5900 Series: Please upgrade to firmware v3.4 or higher.

Event History

Aug 17, 2023

CVE Published

via MITRE·01:50 AM

Data Sourced

via MITRE·01:50 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?