CVE-2023-33238: Command-injection Vulnerability in Certificate Management

Q: What is the severity of CVE-2023-33238?

The severity of CVE-2023-33238 is critical.

Q: Which firmware versions are affected by CVE-2023-33238?

TN-4900 Series firmware versions v1.2.4 and prior, and TN-5900 Series firmware versions v3.3 and prior are affected by CVE-2023-33238.

Q: What is the vulnerability type of CVE-2023-33238?

CVE-2023-33238 is a command injection vulnerability.

Q: How does CVE-2023-33238 occur?

CVE-2023-33238 occurs due to inadequate input validation in the certificate management function.

Q: Is there a fix available for CVE-2023-33238?

Yes, a fix is available. Please refer to the vendor's security advisory for more information.

Published Aug 17, 2023

Updated

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

Affected Software

8 affected components

All of the following

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

All of the following

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

Remediation

Patch Available

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities

Information

Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below: * TN-4900 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * TN-5900 Series: Please upgrade to firmware v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * EDR-810 Series: Please upgrade to firmware v5.12.29 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-810-series#resources * EDR-G902 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series * EDR-G903 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources * EDR-G9010 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources * NAT-102 Series: Please upgrade to firmware v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources

Event History

Aug 17, 2023

CVE Published

via MITRE·02:04 AM

Data Sourced

via MITRE·02:04 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-33238?