Moxa TN-5900 Series Affected by Multiple OpenSSL Vulnerabilities
Act Now7.5MPSA-230405Oct 4, 2024
Summary
The Moxa TN-5900 Series appliance is affected by three OpenSSL vulnerabilities: CVE-2022-4304 (timing-based side-channel attack allowing plaintext recovery of the pre-master secret and decryption of application data), CVE-2023-0215 (use-after-free memory flaw causing crashes), and CVE-2023-0286 (type confusion enabling arbitrary memory reads or denial of service). All three are remotely exploitable without authentication. No firmware patch is available for any version of the TN-5900.
What this means
What could happen
An attacker could decrypt encrypted traffic sent over TLS connections, cause the device to crash, or read sensitive data from device memory by exploiting OpenSSL flaws in the TN-5900 appliance. This could expose configuration data, credentials, or operational communications.
Who's at risk
This affects any organization running Moxa TN-5900 Series industrial appliances (all versions), including facilities using these devices for secure remote management, data collection, or encrypted communication in water treatment, power distribution, manufacturing, and critical infrastructure environments.
How it could be exploited
An attacker with network access to the TN-5900 can send specially crafted TLS handshakes or encrypted messages to trigger timing-based side-channel attacks (CVE-2022-4304), crash the device through memory management flaws (CVE-2023-0215), or exploit type confusion to read memory or cause denial of service (CVE-2023-0286). All three vulnerabilities are remotely exploitable without authentication.
Prerequisites
- Network access to the TN-5900 device on ports that handle TLS/encrypted communications (typically port 443 or management ports)
- No authentication required—the device must accept TLS connections from the attacker's network
Remotely exploitableNo authentication requiredHigh EPSS score (88.5%)No patch availableAffects confidentiality and availability of deviceDefault or unavoidable TLS/encryption exposure in typical deployments
Exploitability
High exploit probability (EPSS 88.5%)
Affected products (1)
ProductAffected VersionsFix Status
TN-5900All versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/2HARDENINGIsolate TN-5900 devices from untrusted networks using firewall rules; restrict access to management interfaces and encrypted communication ports to authorized IP ranges only
WORKAROUNDDisable TLS or encrypted communication features on the TN-5900 if not required for operations, to reduce the attack surface
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGMonitor TN-5900 devices for unexpected crashes or connection resets that may indicate exploitation attempts
Long-term hardening
0/1HOTFIXContact Moxa to confirm end-of-life status and explore migration to a supported product line, as no patch is available for TN-5900
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f27a387e-6926-47b5-86ab-bcc0eea8c667