Critical severity · published Aug 17, 2023
CVE-2023-33238
Command-injection Vulnerability in Certificate Management
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
EDR-810 Series · Moxa
1.0 through 5.12.27 · source: vendor
ES
EDR-G9010 Series · Moxa
1.0 through 2.1 · source: vendor
ES
EDR-G902 Series · Moxa
1.0 through 5.7.17 · source: vendor
ES
EDR-G903 Series · Moxa
1.0 through 5.7.15 · source: vendor
NS
NAT-102 Series · Moxa
1.0 through 1.0.3 · source: vendor
TS
TN-4900 Series · Moxa
1.0 through 1.2.4 · source: vendor
TS
TN-5900 Series · Moxa
1.0 through 3.3 · source: vendor
TF
Tn-4900 Firmware · Moxa
through 1.2.4 · source: NVD
TF
Tn-5900 Firmware · Moxa
through 3.3 · source: NVD
ED
Edr-810 · Moxa
1.0 through 5.12.27 · source: CISA
ED
Edr-g9010 · Moxa
1.0 through 2.1 · source: CISA
ED
Edr-g902 · Moxa
1.0 through 5.7.17 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33238
Patch
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
More from EDR-810 Series
9.8
CVE-2023-34214
Second Order Command-injection Vulnerability in the Certificate-generation Function
9.8
CVE-2023-33239
Second Order Command-injection Vulnerability in the Key-generation Function
9.2
CVE-2025-0415
Command Injection in NTP Setting
8.6
CVE-2025-0676
Commend Injection Leading to Privilege Escalation
7.5
CVE-2023-4452
Web Server Buffer Overflow Vulnerability