Security Resilience

CVE-2023-39979

Crypto Weakness in Moxa Mxsecurity ≤ 1.1.0

Crypto Weakness
Published
02 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0098 61th percentile
Risk Priority 73 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-39979 is a critical-severity Small Space of Random Values (CWE-334) vulnerability in Moxa Mxsecurity. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 39% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.  

CWE(s)
CWE-334CWE-330

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1008 Fallback Channels Command And Control
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-33236Same product: Moxa Mxsecurity
CVE-2024-4739Same product: Moxa Mxsecurity
CVE-2023-33235Same product: Moxa Mxsecurity
CVE-2023-39981Same product: Moxa Mxsecurity
CVE-2023-39980Same product: Moxa Mxsecurity
CVE-2024-4740Same product: Moxa Mxsecurity
CVE-2023-39982Same product: Moxa Mxsecurity
CVE-2023-39983Same product: Moxa Mxsecurity
CVE-2023-5962Same vendor: Moxa
CVE-2023-3336Same vendor: Moxa

Affected Assets

moxa
mxsecurity
≤ 1.1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-330

Key generation under controlled management uses approved random-bit sources rather than insufficiently random values.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 partial match
blocks

Authentication mechanisms often depend on random values (nonces, tokens), so the control can reduce exposure but eliminating the CWE does not achieve authentication outcomes.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require cryptographically strong RNGs with adequate value space, while fixing only this CWE addresses one narrow aspect of the control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.19 Installation of software on operational systems partial match
removes
A.8.24 Use of cryptography partial match
blocks

Cryptographic controls require adequate key/seed entropy, directly mitigating small random-value spaces.

A.8.25 Secure development life cycle partial match
blocks

Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.

A.8.26 Application security requirements partial match
removes
A.8.28 Secure coding partial match
prevents

Secure-coding standards explicitly call for cryptographically strong random number generation.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect insufficient randomness in tokens, session IDs, or keys.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

References