All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-54765 All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.
Fixes

Solution

Due to design restrictions, we could not fix this vulnerability in NPort 5000 Series. We suggest users follow the instructions in the hardening guide https://www.moxa.com/getmedia/67b5e549-a125-4a6a-b99b-23017c75cfc1/moxa-the-security-hardening-guide-for-the-nport-5000-series-tech-note-v1.1.pdf in order to mitigate this vulnerability. Additionally, refer to the following mitigation measures to deploy the product in an appropriate product security context. Moxa recommends users follow these CISA recommendations. Users should * Reduce network exposure by ensuring that all control system devices and systems are not accessible from the Internet. * Place control system networks and remote devices behind firewalls, isolating them from business networks. * When remote access is necessary, employ secure methods such as Virtual Private Networks (VPNs). It is important to note that VPNs may have vulnerabilities and should be kept up to date with the latest available version. Remember that the security of a VPN depends on the security of its connected devices.


Workaround

No workaround given by the vendor.

History

Mon, 23 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Moxa nport 5100
Moxa nport 5100a
Moxa nport 5100ai M12
Moxa nport 5200 Series Firmware
Moxa nport 5200a Series Firmware
Moxa nport 5600 Dt
Moxa nport 5600 Series Firmware
Moxa nport Ia 5000
Moxa nport Ia 5000a
Moxa nport Ia 5000a Io
Moxa nport Iaw 5000a Io
CPEs cpe:2.3:a:moxa:nport_5100:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_5100ai_m12:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_5600_dt:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_5600_series_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_ia_5000:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_ia_5000a:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_ia_5000a_io:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_iaw_5000a_io:*:*:*:*:*:*:*:*
cpe:2.3:a:moxa:nport_p5150a:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:nport_5100a:-:*:*:*:*:*:*:*
cpe:2.3:o:moxa:nport_5200_series_firmware:2.7:*:*:*:*:*:*:*
cpe:2.3:o:moxa:nport_5200a_series_firmware:1.2:*:*:*:*:*:*:*
Vendors & Products Moxa nport 5100
Moxa nport 5100a
Moxa nport 5100ai M12
Moxa nport 5200 Series Firmware
Moxa nport 5200a Series Firmware
Moxa nport 5600 Dt
Moxa nport 5600 Series Firmware
Moxa nport Ia 5000
Moxa nport Ia 5000a
Moxa nport Ia 5000a Io
Moxa nport Iaw 5000a Io
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Moxa

Published:

Updated: 2024-09-23T13:29:04.471Z

Reserved: 2023-09-13T01:12:13.466Z

Link: CVE-2023-4929

cve-icon Vulnrichment

Updated: 2024-08-02T07:44:52.628Z

cve-icon NVD

Status : Modified

Published: 2023-10-03T14:15:11.307

Modified: 2024-11-21T08:36:17.250

Link: CVE-2023-4929

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.