Vulnerability Details : CVE-2023-5627
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-5627
- cpe:2.3:o:moxa:nport_6150-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6150_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250-m-sc-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250-m-sc_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250-s-sc-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250-s-sc_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6250_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6450-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6450_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-16-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-16_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-32-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-32_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-8-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6610-8_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-16-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-16-hv-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-16-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-16_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-32-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-32-hv-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-32_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-8-48v_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-8-hv-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-8-t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:moxa:nport_6650-8_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-5627
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-5627
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
Moxa Inc. |
CWE ids for CVE-2023-5627
-
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.Assigned by: psirt@moxa.com (Secondary)
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
-
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.Assigned by: psirt@moxa.com (Secondary)
-
The product uses a broken or risky cryptographic algorithm or protocol.Assigned by:
- nvd@nist.gov (Primary)
- psirt@moxa.com (Secondary)
References for CVE-2023-5627
-
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-232905-nport-6000-series-incorrect-implementation-of-authentication-algorithm-vulnerability
NPort 6000 Series Incorrect Implementation of Authentication Algorithm VulnerabilityVendor Advisory
Jump to