PT-2024-7131 · Moxa · Moxa Edr-8010+6

Lars Haulin · Published 2024-10-14 · Updated 2024-10-19 · CVE-2024-9139

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDR-8010 versions (affected versions not specified) Moxa EDR-G9004 versions (affected versions not specified) Moxa EDR-G9010 versions (affected versions not specified) Moxa EDF-G1002-BP versions (affected versions not specified) Moxa NAT-102 versions (affected versions not specified) Moxa G4302-LTE4 versions (affected versions not specified) Moxa TN-4900 versions (affected versions not specified)

Description The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. This issue exists due to the failure to neutralize special elements. Exploitation of the issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-08460

CVE-2024-9139

Affected Products

Moxa Edf-G1002-Bp

Moxa Edr-8010

Moxa Edr-G9004

Moxa Edr-G9010

Moxa G4302-Lte4

Moxa Nat-102

Moxa Tn-4900

References · 19

• https://moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08460 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9139 · Security Note
• https://moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-8010-series#resources · Note
• https://t.me/latest_high_impact_cve/1321 · Telegram Post
• https://twitter.com/Patrowl_io/status/1845850838142464169 · Twitter Post
• https://moxa.com/en/products/industrial-network-infrastructure/cellular-gateways-routers/cellular-routers/oncell-g4302-lte4-series#resources · Note
• https://twitter.com/the_yellow_fall/status/1846001833325875662 · Twitter Post
• https://moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources · Note
• https://twitter.com/VulmonFeeds/status/1845778989417177189 · Twitter Post
• https://twitter.com/cracbot/status/1847518096619426099 · Twitter Post
• https://t.me/cvedetector/7805 · Telegram Post
• https://moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-4900-series#resources · Note
• https://twitter.com/cracbot/status/1846793357877715013 · Twitter Post
• https://moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9004-series#resources · Note