CVE-2023-33238: high-severity vulnerability in Moxa TN-4900 Series
Command-injection Vulnerability in Certificate Management
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.8%
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Moxa · EDR-810 SeriesMoxa · EDR-G9010 SeriesMoxa · EDR-G902 SeriesMoxa · EDR-G903 SeriesMoxa · NAT-102 SeriesMoxa · TN-4900 SeriesMoxa · TN-5900 SeriesRelated CVEs — Moxa TN-4900 Series
In the same product, most dangerous first.
CVE-2024-9140CRITICALCVE-2024-9140EPSS 1.8%CVE-2024-9139HIGHOS Command Injection in Restricted CommandEPSS 1.4%CVE-2023-33239HIGHSecond Order Command-injection Vulnerability in the Key-generation FunctionEPSS 1.3%CVE-2024-9138HIGHPrivilege Escalation in Cellular Router, Secure Router, and Network Security AppliancesEPSS 1.1%CVE-2025-0676HIGHCommend Injection Leading to Privilege EscalationEPSS 1.0%CVE-2023-34216HIGHSecond Order Command-injection Vulnerability in the Key-delete FunctionEPSS 0.7%