{"id":"CVE-2023-33235","state":"PUBLISHED","title":"MXsecurity Command Injection Vulnerability","description":"MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted shell and subsequently execute arbitrary code.\n\n","publishedAt":"2023-05-22T05:38:29.841Z","updatedAt":"2025-01-21T21:45:49.327Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"Moxa"},"assigner":"Moxa","products":["Moxa MXsecurity Series"],"affected":[{"vendor":"Moxa","product":"MXsecurity Series","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities"],"weaknesses":["CWE-77"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/33xxx/CVE-2023-33235.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-33235","state":"PUBLISHED","datePublished":"2023-05-22T05:38:29.841Z","dateUpdated":"2025-01-21T21:45:49.327Z","assignerShortName":"Moxa","assignerOrgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","dateReserved":"2023-05-19T02:30:16.483Z"},"containers":{"cna":{"title":"MXsecurity Command Injection Vulnerability","descriptions":[{"lang":"en","value":"MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted shell and subsequently execute arbitrary code.\n\n"}],"affected":[{"vendor":"Moxa","product":"MXsecurity Series","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Moxa","orgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","dateUpdated":"2023-05-22T05:38:29.841Z"},"impacts":[{"capecId":"CAPEC-248","descriptions":[{"lang":"en","value":"CAPEC-248 Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:<br><ul><li>MXsecurity Series: Please upgrade to software v1.0.1 or higher.</li></ul>"}],"value":"Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:\n  *  MXsecurity Series: Please upgrade to software v1.0.1 or higher.\n\n\n"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:39:35.741Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-21T21:45:25.324487Z","id":"CVE-2023-33235","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-21T21:45:49.327Z"}}]}}}