CVE-2023-1257

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-12585.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modCVE-2023-12595.5The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15CVE-2023-12608.0An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has beeCVE-2023-12615.3Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.CVE-2023-12625.3Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages tCVE-2023-12635.3The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via CVE-2023-12645.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.CVE-2023-12654.5An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.1CVE-2023-12679.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue CVE-2023-12699.8Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-12705.4Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.CVE-2023-12738.8The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to incl
CVE-2023-1257: Medium severity, CVSS 6.8 | Vulnix