CVE-2023-28697CWE-306

Moxa MiiNePort E1 - Broken Access Control

Critical · published April 27, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

🔥 An unauthenticated remote user can exploit this vulnerability in Moxa MiiNePort E1 with just a few clicks – like giving a stranger the keys to your server! Imagine a restaurant where anyone can walk in and access the kitchen without a reservation or permission – that’s what’s happening here with insufficient access control. It’s a recipe for disaster! An attacker could manipulate the system at will, potentially causing service disruptions, stealing sensitive data, or even launching further attacks. This is absolutely devastating, as it puts critical operations at risk and can lead to significant downtime and damage.

Put simply

Imagine a restaurant where anyone can walk in and access the kitchen without a reservation or permission – that’s what’s happening here with insufficient access control. It’s a recipe for disaster! This vulnerability allows remote users to perform arbitrary system operations due to insufficient access control, meaning they can bypass authentication and execute unauthorized commands.

What to do

An attacker could manipulate the system at will, potentially causing service disruptions, stealing sensitive data, or even launching further attacks. This is absolutely devastating, as it puts critical operations at risk and can lead to significant downtime and damage. Patch your Moxa MiiNePort E1 to the latest version to close this access gap immediately. Review your access controls and ensure that only authenticated users can interact with critical system components. You’ve got this! Fixing this vulnerability will make your systems much more secure. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00887 · 58.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-04-27T00:00Z
EPSS history
Timeline
  • 27 APR 00:00Z
    Moxa MiiNePort E1 - Broken Access Control
    cvelistv5