CVE-2023-4929

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
Moxa	NPort 5000AI-M12 Series	>= 1.0, <= 1.5
Moxa	NPort 5100 Series	>= 1.0, <= 3.10
Moxa	NPort 5100A Series	>= 1.0, <= 1.6
Moxa	NPort 5200 Series	>= 1.0, <= 2.12
Moxa	NPort 5200A Series	>= 1.0, <= 1.6
Moxa	NPort 5400 Series	>= 1.0, <= 3.14
Moxa	NPort 5600 Series	>= 1.0, <= 3.11
Moxa	NPort 5600-DT Series	>= 1.0, <= 2.9
Moxa	NPort IA5000 Series	>= 1.0, <= 2.1
Moxa	NPort IA5000A Series	>= 1.0, <= 2.0
Moxa	NPort IA5000A-I/O Series	>= 1.0, <= 2.0
Moxa	NPort IAW5000A-I/O Series	>= 1.0, <= 2.2
Moxa	NPort P5150A Series	>= 1.0, <= 1.6
moxa	nport_5100ai_m12	>= 1.0, <= 1.5
moxa	nport_5100	>= 1.0, <= 3.10
moxa	nport_5100a	>= 1.0, <= 1.6
moxa	nport_5200_series_firmware	>= 1.0, <= 2.12
moxa	nport_5200a_series_firmware	>= 1.0, <= 2.12
moxa	nport_5600_series_firmware	>= 1.0, <= 3.11
moxa	nport_5600_dt	>= 1.0, <= 2.9
moxa	nport_ia_5000	>= 1.0, <= 2.1
moxa	nport_ia_5000a	>= 1.0, <= 2.0
moxa	nport_ia_5000a_io	>= 1.0, <= 2.0
moxa	nport_iaw_5000a_io	>= 1.0, <= 2.2
moxa	nport_p5150a	>= 1.0, <= 1.6

References

Timeline

Published: Oct 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-492905.3lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too CVE-2023-492919.8tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub CVE-2023-492924.8ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could CVE-2023-492936.1Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original requ CVE-2023-492947.5Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well CVE-2023-492956.5quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory CVE-2023-492966.1The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from CVE-2023-492977.8PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization CVE-2023-492987.5OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file da CVE-2023-492998.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be CVE-2023-49306.5The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to privat CVE-2023-49317.8Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by