CVE-2023-34216: Second Order Command-injection Vulnerability in the Key-delete Function

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-34216.

Q: What is the severity of CVE-2023-34216?

The severity of CVE-2023-34216 is high with a CVSS score of 8.1.

Q: What is the vulnerability in TN-4900 and TN-5900 Series firmware?

The vulnerability in TN-4900 and TN-5900 Series firmware is a command-injection vulnerability that allows malicious users to delete keys.

Q: How can I fix CVE-2023-34216?

To fix CVE-2023-34216, update the firmware to a version above v1.2.4 for TN-4900 Series and above v3.3 for TN-5900 Series.

Published Aug 17, 2023

Updated

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files.

Affected Software

4 affected components

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

Remediation

Patch Available

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities

Information

Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below: * * TN-4900 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * TN-5900 Series: Please upgrade to firmware v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * EDR-G902 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series * EDR-G903 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources * EDR-G9010 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources * NAT-102 Series: Please upgrade to firmware v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources

Event History

Aug 17, 2023

CVE Published

via MITRE·06:41 AM

Data Sourced

via MITRE·06:41 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-34216.

What is the severity of CVE-2023-34216?

The severity of CVE-2023-34216 is high with a CVSS score of 8.1.

Which firmware versions are affected by CVE-2023-34216?

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are affected by CVE-2023-34216.

What is the vulnerability in TN-4900 and TN-5900 Series firmware?