CVE-2023-34216: high-severity vulnerability in Moxa TN-4900 Series
Second Order Command-injection Vulnerability in the Key-delete Function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.7%
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
Moxa · EDR-G9010 SeriesMoxa · EDR-G902 SeriesMoxa · EDR-G903 SeriesMoxa · NAT-102 SeriesMoxa · TN-4900 SeriesMoxa · TN-5900 SeriesRelated CVEs — Moxa TN-4900 Series
In the same product, most dangerous first.
CVE-2024-9140CRITICALCVE-2024-9140EPSS 1.8%CVE-2024-9139HIGHOS Command Injection in Restricted CommandEPSS 1.4%CVE-2023-33239HIGHSecond Order Command-injection Vulnerability in the Key-generation FunctionEPSS 1.3%CVE-2024-9138HIGHPrivilege Escalation in Cellular Router, Secure Router, and Network Security AppliancesEPSS 1.1%CVE-2025-0676HIGHCommend Injection Leading to Privilege EscalationEPSS 1.0%CVE-2023-33238HIGHCommand-injection Vulnerability in Certificate ManagementEPSS 0.8%