#VU80340 Improperly Controlled Modification of Dynamically-Determined Object Attributes in MXsecurity - CVE-2023-39983

Vulnerability identifier: #VU80340

Vulnerability risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-39983

CWE-ID: CWE-915

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
MXsecurity
Server applications / Other server solutions

Vendor: Moxa

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes. A remote attacker can register/add a device via the nsm-web application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MXsecurity: 1.0 - 1.0.1

---

External links
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
https://www.tenable.com/security/research/tra-2023-30

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.