Vulnerability · Published Oct 14, 2024 · Assigned by Moxa
CVE-2024-9137Moxa Service Missing Authentication for Critical Function
Critical 9.4
In plain English
A critical-severity missing authentication in EDF-G1002-BP Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moxa | EDR-8010 Series | 1.0 – through 3.12.1 |
| Moxa | EDR-G9004 Series | 1.0 – through 3.12.1 |
| Moxa | EDR-G9010 Series | 1.0 – through 3.12.1 |
| Moxa | EDF-G1002-BP Series | 1.0 – through 3.12.1 |
| Moxa | NAT-102 Series | 1.0 – through 1.0.5 |
| Moxa | OnCell G4302-LTE4 Series | 1.0 – through 3.9 |
| Moxa | TN-4900 Series | 1.0 – through 3.6 |
| Moxa | EDS-608 Series | 1.0 – through 3.12 |
| Moxa | EDS-611 Series | 1.0 – through 3.12 |
| Moxa | EDS-616 Series | 1.0 – through 3.12 |
| Moxa | EDS-619 Series | 1.0 – through 3.12 |
| Moxa | EDS-405A Series | 1.0 – through 3.14 |
| Moxa | EDS-408A Series | 1.0 – through 3.12 |
| Moxa | EDS-505A Series | 1.0 – through 3.11 |
| Moxa | EDS-508A Series | 1.0 – through 3.11 |
| Moxa | EDS-510A Series | 1.0 – through 3.12 |
| Moxa | EDS-516A Series | 1.0 – through 3.11 |
| Moxa | EDS-518A Series | 1.0 – through 3.11 |
| Moxa | EDS-G509 Series | 1.0 – through 3.10 |
| Moxa | EDS-P510 Series | 1.0 – through 3.11 |
| Moxa | EDS-P510A Series | 1.0 – through 3.11 |
| Moxa | EDS-510E Series | 1.0 – through 5.5 |
| Moxa | EDS-518E Series | 1.0 – through 6.3 |
| Moxa | EDS-528E Series | 1.0 – through 6.3 |
| Moxa | EDS-G508E Series | 1.0 – through 6.4 |
| Moxa | EDS-G512E Series | 1.0 – through 6.4 |
| Moxa | EDS-G516E Series | 1.0 – through 6.4 |
| Moxa | EDS-P506E Series | 1.0 – through 5.8 |
| Moxa | ICS-G7526A Series | 1.0 – through 5.10 |
| Moxa | ICS-G7528A Series | 1.0 – through 5.10 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
References
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances vendor-advisory
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches vendor-advisory