Security Resilience

CVE-2023-4227

Access Control in Moxa Iologik E4200 Firmware ≤ 1.6

Access Control
Published
24 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0036 28th percentile
Risk Priority 44 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-4227 is a medium-severity Active Debug Code (CWE-489) vulnerability in Moxa Iologik E4200 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft,…

more

and unauthorized manipulation of sensitive information. The vulnerability is attributed to the presence of an unauthorized service, which could potentially enable unauthorized access to the. device.

CWE(s)
CWE-489CWE-863

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1008 Fallback Channels Command And Control
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1020.001 Traffic Duplication Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-4228Same product: Moxa Iologik E4200
CVE-2023-4229Same product: Moxa Iologik E4200
CVE-2023-4230Same product: Moxa Iologik E4200
CVE-2023-33237Same vendor: Moxa
CVE-2024-6785Same vendor: Moxa
CVE-2023-39982Same vendor: Moxa
CVE-2023-5627Same vendor: Moxa
CVE-2023-5035Same vendor: Moxa
CVE-2023-5962Same vendor: Moxa
CVE-2023-3336Same vendor: Moxa

Affected Assets

moxa
iologik e4200 firmware
≤ 1.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-863

Periodic review and update of procedures reduces incorrect authorization implementations over time.

AC-13 Supervision and Review — Access Control
addresses: CWE-863

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

AC-16 Security and Privacy Attributes
addresses: CWE-863

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

AC-17 Remote Access
addresses: CWE-863

The authorization process and usage restrictions help prevent incorrect authorization for remote access types.

AC-18 Wireless Access
addresses: CWE-863

Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.

AC-19 Access Control for Mobile Devices
addresses: CWE-863

Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.

AC-2 Account Management
addresses: CWE-863

Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.

AC-20 Use of External Systems
addresses: CWE-863

Ensures authorization decisions for external system use are correctly implemented and enforced.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require removal of debug code before release, covering most of this weakness while the control addresses many other development issues.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
blocks

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

A.5.18 Access rights partial match
blocks

A.5.18's provisioning, revocation, review and adjustment of access rights (incl. before role changes/termination, with segregation and owner approval) directly stops incorrect authorization decisions from being exploitable in the vast majority of cases; the bounded remainder is incorrectness inside the authorization logic itself (e.g. flawed conditional or missing check) rather than rights that were wrongly granted.

A.8.19 Installation of software on operational systems partial match
removes
A.8.25 Secure development life cycle partial match
blocks

A.8.25 mandates secure SDLC practices including secure coding, security testing, checkpoints, and developer training that reduce the chance of shipping active debug code, but does not guarantee its absence in every release (e.g. via incomplete enforcement or outsourced gaps).

A.8.26 Application security requirements partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly prohibit leaving debug code active in production.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References