CVE-2023-34217
📋 TL;DR
This vulnerability allows authenticated attackers to delete arbitrary files on affected TN-4900 and TN-5900 Series devices through command injection in the certificate-delete function. The insufficient input validation enables malicious users to execute system commands, potentially leading to system compromise. Organizations using these specific firmware versions are affected.
💻 Affected Systems
- TN-4900 Series
- TN-5900 Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through file deletion leading to denial of service, privilege escalation, or installation of persistent backdoors.
Likely Case
Unauthorized file deletion causing service disruption, configuration loss, or partial system compromise.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Exploitation requires authenticated access but command injection is straightforward once access is obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TN-4900: v1.2.5 or later, TN-5900: v3.4 or later
Vendor Advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
Restart Required: Yes
Instructions:
1. Download latest firmware from Moxa support portal. 2. Backup current configuration. 3. Upload firmware via web interface. 4. Apply firmware update. 5. Restart device. 6. Verify version update.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to device web interface to trusted IP addresses only
Disable Unused Accounts
allRemove or disable any unnecessary user accounts with web interface access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Enforce strong authentication and limit user privileges to essential functions only
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > About or using CLI command: show versionCheck Version:
show versionVerify Fix Applied:
Verify firmware version is TN-4900 v1.2.5+ or TN-5900 v3.4+📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events
- Multiple failed authentication attempts followed by certificate operations
- Command execution patterns in system logs
Network Indicators:
- Unusual traffic to certificate-delete endpoints
- Multiple authentication attempts from single source
SIEM Query:
source="device_logs" AND (event="certificate_delete" OR event="file_delete") AND user!="admin"