PT-2022-5107 · Moxa · Moxa Edr-G902 Series+2

Published 2022-02-11 · Updated 2022-02-11

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDR-G903 series versions (affected versions not specified) Moxa EDR-G902 series versions (affected versions not specified) Moxa EDR-810 series versions (affected versions not specified)

Description The issue is related to the use of hardcoded credentials in the firmware of Moxa industrial routers. An attacker can exploit this to gain full access to the device using specially crafted credentials.

Recommendations For Moxa EDR-G903 series: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Moxa EDR-G902 series: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Moxa EDR-810 series: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-06355

Affected Products

Moxa Edr-810 Series

Moxa Edr-G902 Series

Moxa Edr-G903 Series

References · 2

• https://bdu.fstec.ru/vul/2022-06355 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/edr-g903-g902-810-secure-routers-vulnerability-(1) · Note