Details of VAR-202303-0165

ID

VAR-202303-0165

CVE

CVE-2023-1257

TITLE

plural Moxa Inc. Vulnerabilities related to improper physical access controls in products

Trust: 0.8

sources: JVNDB: JVNDB-2023-005117

DESCRIPTION

An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system. UC-2101-LX firmware, UC-2102-LX firmware, UC-2102-T-LX firmware etc. Moxa Inc. The product contains a vulnerability related to improper physical access control.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-1257 // JVNDB: JVNDB-2023-005117 // VULMON: CVE-2023-1257

AFFECTED PRODUCTS

vendor:	moxa	model:	uc-2102-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-8540-t-ct-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-2111-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-us-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-eu-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8210-t-lx-s	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-8580-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-8410a-t-lx	scope:	eq	version:	2.2	Trust: 1.0
vendor:	moxa	model:	uc-8580-t-ct-q-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-2112-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-2102-t-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-ap-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-us-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-eu-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-us-lx-nw	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8162-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-us-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-us-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-ap-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-eu-s	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-us-lx-nw	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-2114-t-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-ap-s	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-8540-lx	scope:	lte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-s	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-8580-t-ct-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-8410a-nw-lx	scope:	eq	version:	2.2	Trust: 1.0
vendor:	moxa	model:	uc-2104-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-eu-lx-nw	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-8112-me-t-lx	scope:	lte	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-ap-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-5112-t-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8540-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-eu-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8112-me-t-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-ap-s	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-8410a-nw-t-lx	scope:	eq	version:	2.2	Trust: 1.0
vendor:	moxa	model:	uc-2102-t-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-5112-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-ap-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8410a-lx	scope:	eq	version:	2.2	Trust: 1.0
vendor:	moxa	model:	uc-5101-t-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2114-t-lx	scope:	eq	version:	-	Trust: 1.0
vendor:	moxa	model:	uc-2116-t-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-5111-t-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8580-q-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-8540-t-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-2101-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-8540-t-lx	scope:	lte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2104-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-ap-lx-nw	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-eu-s	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-8112-me-t-lx1	scope:	lte	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-s	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-5102-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2116-t-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-8112a-me-t-lx	scope:	lte	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-eu-lx-nw	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2102-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-8580-t-q-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-5111-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-ap-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-8112a-me-t-lx	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-eu-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2101-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-2112-lx	scope:	gte	version:	1.3	Trust: 1.0
vendor:	moxa	model:	uc-8112-me-t-lx1	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-us-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-2111-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-ap-lx-nw	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-us-s	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-3121-t-eu-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-eu-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-8112-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8131-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8210-t-lx-s	scope:	lte	version:	2.4	Trust: 1.0
vendor:	moxa	model:	uc-5101-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-2114-t-lx	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	uc-8580-t-lx	scope:	eq	version:	1.1	Trust: 1.0
vendor:	moxa	model:	uc-8132-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3111-t-us-lx	scope:	gte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-5102-t-lx	scope:	eq	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-8540-t-ct-lx	scope:	lte	version:	1.2	Trust: 1.0
vendor:	moxa	model:	uc-3101-t-ap-lx	scope:	lte	version:	2.0	Trust: 1.0
vendor:	moxa	model:	uc-8220-t-lx-us-s	scope:	gte	version:	1.0	Trust: 1.0
vendor:	moxa	model:	uc-2112-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3121-t-ap-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2114-t-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-eu-lx-nw	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-ap-lx-nw	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2116-t-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2111-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3101-t-us-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-us-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3101-t-ap-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2104-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2102-t-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2102-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3121-t-eu-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-us-lx-nw	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-ap-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-2101-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3101-t-eu-lx	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	uc-3111-t-eu-lx	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-005117 // NVD: CVE-2023-1257

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2023-1257
value:	MEDIUM
Trust: 1.8
ics-cert@hq.dhs.gov:	CVE-2023-1257
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202303-484
value:	MEDIUM
Trust: 0.6

NVD:
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.1
Trust: 1.0
ics-cert@hq.dhs.gov:
baseSeverity:	HIGH
baseScore:	7.6
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2023-1257
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-005117 // NVD: CVE-2023-1257 // NVD: CVE-2023-1257 // CNNVD: CNNVD-202303-484

PROBLEMTYPE DATA

problemtype:

inadequate physical access controls (CWE-1263) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-005117

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202303-484

CONFIGURATIONS

sources: NVD: CVE-2023-1257

PATCH

title:

Moxa UC Security vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=228999

Trust: 0.6

sources: CNNVD: CNNVD-202303-484

EXTERNAL IDS

db:	NVD	id:	CVE-2023-1257	Trust: 3.3
db:	ICS CERT	id:	ICSA-22-333-04	Trust: 2.5
db:	JVNDB	id:	JVNDB-2023-005117	Trust: 0.8
db:	CNNVD	id:	CNNVD-202303-484	Trust: 0.6
db:	VULMON	id:	CVE-2023-1257	Trust: 0.1

sources: VULMON: CVE-2023-1257 // JVNDB: JVNDB-2023-005117 // NVD: CVE-2023-1257 // CNNVD: CNNVD-202303-484

REFERENCES

url:	https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-04	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2023-1257	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-1257/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/1263.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-1257 // JVNDB: JVNDB-2023-005117 // NVD: CVE-2023-1257 // CNNVD: CNNVD-202303-484

SOURCES

db:	VULMON	id:	CVE-2023-1257
db:	JVNDB	id:	JVNDB-2023-005117
db:	NVD	id:	CVE-2023-1257
db:	CNNVD	id:	CNNVD-202303-484

LAST UPDATE DATE

2023-12-18T13:41:47.519000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-1257	date:	2023-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2023-005117	date:	2023-11-06T07:25:00
db:	NVD	id:	CVE-2023-1257	date:	2023-11-07T04:02:56.573
db:	CNNVD	id:	CNNVD-202303-484	date:	2023-03-15T00:00:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-1257	date:	2023-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2023-005117	date:	2023-11-06T00:00:00
db:	NVD	id:	CVE-2023-1257	date:	2023-03-07T17:15:12.527
db:	CNNVD	id:	CNNVD-202303-484	date:	2023-03-07T00:00:00