CVE-2023-34217: Second Order Command-injection Vulnerability in the Certificate-delete Function

Q: What is CVE-2023-34217?

CVE-2023-34217 is a command-injection vulnerability in TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior.

Q: What is the severity of CVE-2023-34217?

The severity of CVE-2023-34217 is high with a CVSS score of 8.1.

Q: How does CVE-2023-34217 occur?

CVE-2023-34217 occurs due to insufficient input validation in the certificate-delete function of the affected firmware versions.

Q: What is the potential impact of CVE-2023-34217?

CVE-2023-34217 could potentially allow malicious users to execute arbitrary commands on the affected devices.

Q: How can I fix CVE-2023-34217?

To fix CVE-2023-34217, it is recommended to update the TN-4900 Series firmware to version v1.2.5 or later and the TN-5900 Series firmware to version v3.4 or later.

Published Aug 17, 2023

Updated

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.

Affected Software

4 affected components

MOXA Tn-5900 Firmware<=3.3

MOXA TN-5900

MOXA Tn-4900 Firmware<=1.2.4

MOXA Tn-4900

Remediation

Patch Available

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities

Information

Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below: * * TN-4900 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * TN-5900 Series: Please upgrade to firmware v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources * EDR-G902 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series * EDR-G903 Series: Please upgrade to firmware v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources * EDR-G9010 Series: Please upgrade to firmware v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources * NAT-102 Series: Please upgrade to firmware v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources

Event History

Aug 17, 2023

CVE Published

via MITRE·06:48 AM

Data Sourced

via MITRE·06:48 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-34217?