« Volver al listado

CVE-2023-34217

Estado: ModificadaAlta (8.1)—

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Moxa — Tn-4900 FirmwareMoxa — Tn-5900 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34217",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34217",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T19:43:12.616230Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@moxa.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@moxa.com",
      "affectedData": [
        {
          "vendor": "Moxa",
          "product": "TN-5900 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "3.3"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moxa",
          "product": "TN-4900 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.2.4"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moxa",
          "product": "EDR-G902 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.7.17"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moxa",
          "product": "EDR-G903 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.7.15"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moxa",
          "product": "EDR-G9010 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moxa",
          "product": "NAT-102 Series",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.0.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-08-17T07:15:43.383",
  "references": [
    {
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@moxa.com"
    },
    {
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@moxa.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files. "
    }
  ],
  "lastModified": "2026-06-17T06:03:08.837",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:moxa:tn-5900_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA65A45-A850-440B-8B4B-191D46059E71",
              "versionEndIncluding": "3.3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:moxa:tn-5900:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7D1E9F45-0ED4-4223-BC9B-D2E01A583DCA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:moxa:tn-4900_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "442E0C68-A369-4079-86CC-0E63408C48E7",
              "versionEndIncluding": "1.2.4"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:moxa:tn-4900:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "56CD9ADD-E963-42F4-A2E5-175A0D2EE8D0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@moxa.com"
}