CVE-2023-33238 Command-injection Vulnerability in Certificate Management
Attackers can execute arbitrary commands on Moxa industrial routers via the certificate management interface due to insufficient input validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33238?
CVE-2023-33238 is a high-severity command injection vulnerability in Moxa EDR-810 Series, published on 17 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
Which versions are affected by CVE-2023-33238?
It affects 2 products.
Products include Moxa Tn-4900 Firmware, Moxa Tn-5900 Firmware.
How do I fix CVE-2023-33238?
No fix has been published for CVE-2023-33238 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-33238 being exploited?
There is no known exploitation of CVE-2023-33238 in the wild and no public exploit code.
Other vulnerabilities in Moxa EDR-810 Series
- CVE-2023-33239 Second Order Command-injection Vulnerability in the Key-generation Function
- CVE-2023-34216 Second Order Command-injection Vulnerability in the Key-delete Function
- CVE-2023-34217 Second Order Command-injection Vulnerability in the Certificate-delete Function
- CVE-2023-34214 Second Order Command-injection Vulnerability in the Certificate-generation Function
Sources
Also known as GHSA-24m3-rcq7-76r2.