CVE-2023-34214
Assigner: Moxa
Published: 2023-08-17T02:26:05.428Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: TN-5900 Series
vendor: Moxa
versions: lessThanOrEqual: 3.3
status: affected
version: 1.0
versionType: custom
defaultStatus: unaffected
product: TN-4900 Series
vendor: Moxa
versions: lessThanOrEqual: 1.2.4
status: affected
version: 1.0
versionType: custom
defaultStatus: unaffected
product: EDR-810 Series
vendor: Moxa
versions: lessThanOrEqual: 5.12.27
status: affected
version: 1.0
versionType: custom
defaultStatus: unaffected
product: EDR-G902 Series
vendor: Moxa
versions: lessThanOrEqual: 5.7.17
status: affected
version: 1.0
versionType: custom
defaultStatus: unaffected
product: EDR-G903 Series
vendor: Moxa
versions: lessThanOrEqual: 5.7.15
status: affected
version: 1.0
versionType: custom
descriptions: supportingMedia: base64: no
type: text/html
value: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious users to execute remote code on affected devices. 
value: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious users to execute remote code on affected devices. 
impacts: capecId: CAPEC-248
descriptions: value: CAPEC-248 Command Injection
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:<br><ul><li><li>TN-4900 Series: <span style="background-color: rgb(255, 255, 255);">Please upgrade to firmware </span><a target="_blank" rel="nofollow" href="https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources">v3.0 or higher.</a></li><li>TN-5900 Series: <span style="background-color: rgb(255, 255, 255);">Please upgrade to firmware </span><a target="_blank" rel="nofollow" href="https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources">v3.4 or higher.</a><span style="background-color: rgb(255, 255, 255);">&nbsp;</span></li><li><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">EDR-810 Series: <span style="background-color: rgb(255, 255, 255);">Please upgrade to firmware </span><a target="_blank" rel="nofollow" href="https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-810-series#resources">v5.12.29 or higher.</a></span></span></li><li><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">EDR-G902 Series: <span style="background-color: rgb(255, 255, 255);">Please upgrade to firmware </span><a target="_blank" rel="nofollow" href="https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series?#resources">v5.7.21 or higher.</a></span></span></span></li><li><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">EDR-G903 Series: <span style="background-color: rgb(255, 255, 255);">Please upgrade to firmware </span><a target="_blank" rel="nofollow" href="https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources">v5.7.21 or higher.</a></span></span></span></span></li></li></ul>
value: Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:
  *    *  TN-4900 Series: Please upgrade to firmware  v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources 
  *  TN-5900 Series: Please upgrade to firmware  v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources  
  *  EDR-810 Series: Please upgrade to firmware  v5.12.29 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-810-series#resources 
  *  EDR-G902 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series 
  *  EDR-G903 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources 




source: discovery: EXTERNAL
title: Second Order Command-injection Vulnerability in the Certificate-generation Function
x_generator: engine: Vulnogram 0.1.0-dev