High severity · published Dec 23, 2023
CVE-2023-5961
ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
ioLogik E1200 Series · Moxa
1.0 through 3.3 · source: vendor
IE
Iologik E1210 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1211 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1212 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1213 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1214 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1240 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1241 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1242 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1260 Firmware · Moxa
before 3.3 · source: NVD
IE
Iologik E1262 Firmware · Moxa
before 3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5961
Vendor Advisory
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability
More from ioLogik E1200 Series
6.5
CVE-2023-5962
ioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability