High severity · published Oct 3, 2023
CVE-2023-4929
NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N5
NPort 5000AI-M12 Series · Moxa
1.0 through 1.5 · source: vendor
N5
NPort 5100 Series · Moxa
1.0 through 3.10 · source: vendor
N5
NPort 5100A Series · Moxa
1.0 through 1.6 · source: vendor
N5
NPort 5200 Series · Moxa
1.0 through 2.12 · source: vendor
N5
NPort 5200A Series · Moxa
1.0 through 1.6 · source: vendor
N5
NPort 5400 Series · Moxa
1.0 through 3.14 · source: vendor
N5
NPort 5600 Series · Moxa
1.0 through 3.11 · source: vendor
N5
NPort 5600-DT Series · Moxa
1.0 through 2.9 · source: vendor
NI
NPort IA5000 Series · Moxa
1.0 through 2.1 · source: vendor
NI
NPort IA5000A Series · Moxa
1.0 through 2.0 · source: vendor
NI
NPort IA5000A-I/O Series · Moxa
1.0 through 2.0 · source: vendor
NI
NPort IAW5000A-I/O Series · Moxa
1.0 through 2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4929
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4929
Vendor Advisory
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-233328-nport-5000-series-firmware-improper-validation-of-integrity-check-vulnerability
More from NPort 5000AI-M12 Series
7.0
CVE-2025-15017
A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface