title: CVE-2023-1257
description: An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.
problem types: CWE-1263
affected:
{
vendor: MOXA
product: UC-8580 Series
versions:
status: affected, version: V1.1
}
{
vendor: MOXA
product: UC-8540 Series
versions:
status: affected, version: V1.0 to V1.2
}
{
vendor: MOXA
product: UC-8410A Series
versions:
status: affected, version: V2.2
}
{
vendor: MOXA
product: UC-8200 Series
versions:
status: affected, version: V1.0 to V2.4
}
{
vendor: MOXA
product: UC-8100A-ME-T Series
versions:
status: affected, version: V1.0 to V1.1
}
{
vendor: MOXA
product: UC-8100 Series
versions:
status: affected, version: V1.2
}
{
vendor: MOXA
product: UC-5100 Series
versions:
status: affected, version: V1.2
}
{
vendor: MOXA
product: UC-3100 Series
versions:
status: affected, version: V1.2 to V2.0
}
{
vendor: MOXA
product: UC-2100 Series
versions:
status: affected, version: V1.3 to V1.5
}
{
vendor: MOXA
product: UC-2100-W Series
versions:
status: affected, version: V1.3 to V1.5
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
baseScore: 7.6
baseSeverity: HIGH
]