CVE-2023-1257 : An attacker with physical access to the affected Moxa UC Series devices can init

An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.

Published 2023-03-07 17:15:13

Updated 2023-03-14 19:25:06

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2023-1257

Moxa » Uc-2101-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2101-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2101-lx » Version: N/A
Moxa » Uc-2102-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2102-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2102-lx » Version: N/A
Moxa » Uc-2104-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2104-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2104-lx » Version: N/A
Moxa » Uc-2111-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2111-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2111-lx » Version: N/A
Moxa » Uc-2112-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2112-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2112-lx » Version: N/A
Moxa » Uc-2102-t-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2102-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2102-t-lx » Version: N/A
Moxa » Uc-2114-t-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2114-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2114-t-lx » Version: N/A
Moxa » Uc-2114-t-lx Firmware » Version: N/A
cpe:2.3:o:moxa:uc-2114-t-lx_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2114-t-lx » Version: N/A
Moxa » Uc-2116-t-lx Firmware
Versions from including (>=) 1.3 and up to, including, (<=) 1.5
cpe:2.3:o:moxa:uc-2116-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-2116-t-lx » Version: N/A
Moxa » Uc-3101-t-us-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3101-t-us-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3101-t-us-lx » Version: N/A
Moxa » Uc-3101-t-eu-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3101-t-eu-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3101-t-eu-lx » Version: N/A
Moxa » Uc-3111-t-us-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-us-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-us-lx » Version: N/A
Moxa » Uc-3111-t-eu-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-eu-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-eu-lx » Version: N/A
Moxa » Uc-3121-t-us-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3121-t-us-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3121-t-us-lx » Version: N/A
Moxa » Uc-3121-t-eu-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3121-t-eu-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3121-t-eu-lx » Version: N/A
Moxa » Uc-3101-t-ap-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3101-t-ap-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3101-t-ap-lx » Version: N/A
Moxa » Uc-3111-t-ap-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-ap-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-ap-lx » Version: N/A
Moxa » Uc-3121-t-ap-lx Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3121-t-ap-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3121-t-ap-lx » Version: N/A
Moxa » Uc-3111-t-eu-lx-nw Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-eu-lx-nw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-eu-lx-nw » Version: N/A
Moxa » Uc-3111-t-ap-lx-nw Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-ap-lx-nw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-ap-lx-nw » Version: N/A
Moxa » Uc-3111-t-us-lx-nw Firmware
Versions from including (>=) 1.2 and up to, including, (<=) 2.0
cpe:2.3:o:moxa:uc-3111-t-us-lx-nw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-3111-t-us-lx-nw » Version: N/A
Moxa » Uc-5101-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5101-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5101-lx » Version: N/A
Moxa » Uc-5101-t-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5101-t-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5101-t-lx » Version: N/A
Moxa » Uc-5102-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5102-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5102-lx » Version: N/A
Moxa » Uc-5102-t-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5102-t-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5102-t-lx » Version: N/A
Moxa » Uc-5111-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5111-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5111-lx » Version: N/A
Moxa » Uc-5111-t-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5111-t-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5111-t-lx » Version: N/A
Moxa » Uc-5112-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5112-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5112-lx » Version: N/A
Moxa » Uc-5112-t-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-5112-t-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-5112-t-lx » Version: N/A
Moxa » Uc-8131-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-8131-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8131-lx » Version: N/A
Moxa » Uc-8132-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-8132-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8132-lx » Version: N/A
Moxa » Uc-8162-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-8162-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8162-lx » Version: N/A
Moxa » Uc-8112-lx Firmware » Version: 1.2
cpe:2.3:o:moxa:uc-8112-lx_firmware:1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8112-lx » Version: N/A
Moxa » Uc-8112-me-t-lx1 Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.1
cpe:2.3:o:moxa:uc-8112-me-t-lx1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8112-me-t-lx1 » Version: N/A
Moxa » Uc-8112-me-t-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.1
cpe:2.3:o:moxa:uc-8112-me-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8112-me-t-lx » Version: N/A
Moxa » Uc-8112a-me-t-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.1
cpe:2.3:o:moxa:uc-8112a-me-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8112a-me-t-lx » Version: N/A
Moxa » Uc-8220-t-lx-s Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8220-t-lx-s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8220-t-lx-s » Version: N/A
Moxa » Uc-8220-t-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8220-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8220-t-lx » Version: N/A
Moxa » Uc-8220-t-lx-us-s Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8220-t-lx-us-s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8220-t-lx-us-s » Version: N/A
Moxa » Uc-8220-t-lx-eu-s Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8220-t-lx-eu-s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8220-t-lx-eu-s » Version: N/A
Moxa » Uc-8220-t-lx-ap-s Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8220-t-lx-ap-s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8220-t-lx-ap-s » Version: N/A
Moxa » Uc-8410a-lx Firmware » Version: 2.2
cpe:2.3:o:moxa:uc-8410a-lx_firmware:2.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8410a-lx » Version: N/A
Moxa » Uc-8410a-t-lx Firmware » Version: 2.2
cpe:2.3:o:moxa:uc-8410a-t-lx_firmware:2.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8410a-t-lx » Version: N/A
Moxa » Uc-8410a-nw-lx Firmware » Version: 2.2
cpe:2.3:o:moxa:uc-8410a-nw-lx_firmware:2.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8410a-nw-lx » Version: N/A
Moxa » Uc-8410a-nw-t-lx Firmware » Version: 2.2
cpe:2.3:o:moxa:uc-8410a-nw-t-lx_firmware:2.2:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8410a-nw-t-lx » Version: N/A
Moxa » Uc-8580-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-lx » Version: N/A
Moxa » Uc-8580-t-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-t-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-t-lx » Version: N/A
Moxa » Uc-8580-t-ct-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-t-ct-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-t-ct-lx » Version: N/A
Moxa » Uc-8580-q-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-q-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-q-lx » Version: N/A
Moxa » Uc-8580-t-q-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-t-q-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-t-q-lx » Version: N/A
Moxa » Uc-8580-t-ct-q-lx Firmware » Version: 1.1
cpe:2.3:o:moxa:uc-8580-t-ct-q-lx_firmware:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8580-t-ct-q-lx » Version: N/A
Moxa » Uc-8540-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.2
cpe:2.3:o:moxa:uc-8540-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8540-lx » Version: N/A
Moxa » Uc-8540-t-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.2
cpe:2.3:o:moxa:uc-8540-t-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8540-t-lx » Version: N/A
Moxa » Uc-8540-t-ct-lx Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 1.2
cpe:2.3:o:moxa:uc-8540-t-ct-lx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8540-t-ct-lx » Version: N/A
Moxa » Uc-8210-t-lx-s Firmware
Versions from including (>=) 1.0 and up to, including, (<=) 2.4
cpe:2.3:o:moxa:uc-8210-t-lx-s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Uc-8210-t-lx-s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-1257

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-1257

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.6	HIGH	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	0.9	6.0	ICS-CERT
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-1257

CWE-1263 Improper Physical Access Control

The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

Assigned by: ics-cert@hq.dhs.gov (Primary)

References for CVE-2023-1257

https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-04

Moxa UC Series | CISA
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2023-1257

Products affected by CVE-2023-1257

Exploit prediction scoring system (EPSS) score for CVE-2023-1257

CVSS scores for CVE-2023-1257

CWE ids for CVE-2023-1257

References for CVE-2023-1257