CVE-2023-33239: Second Order Command-injection Vulnerability in the Key-generation Function

Q: What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2023-33239.

Q: What is the severity of CVE-2023-33239?

The severity of CVE-2023-33239 is critical with a score of 9.8.

Q: What is the cause of CVE-2023-33239?

CVE-2023-33239 is caused by insufficient input validation in the key-generation function.

Q: How can CVE-2023-33239 be exploited?

CVE-2023-33239 can potentially be exploited by malicious users to execute arbitrary commands.

Published Aug 17, 2023

Updated

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.

Affected Software

8 affected components

All of the following

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

All of the following

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

Remediation

Patch Available

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities

Information

Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below: * TN-4900 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * TN-5900 Series: Please upgrade to firmware v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * EDR-810 Series: Please upgrade to firmware v5.12.29 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-810-series#resources * EDR-G902 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series * EDR-G903 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources * EDR-G9010 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources * NAT-102 Series: Please upgrade to firmware v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources

Event History

Aug 17, 2023

CVE Published

via MITRE·02:13 AM

Data Sourced

via MITRE·02:13 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2023-33239.

What is the severity of CVE-2023-33239?

The severity of CVE-2023-33239 is critical with a score of 9.8.

Which firmware versions are affected by CVE-2023-33239?

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are affected by CVE-2023-33239.

What is the cause of CVE-2023-33239?