by Kastro
Paper/Archive/CVE-2024-9137

CVE-2024-9137

Moxa EDR-8010 Series — Moxa Service Missing Authentication for Critical Function

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 42.9.429 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.

Affected

ProductAffectedFixed inSource
EDR-8010 Series1.0 – 3.12.1–CNA
EDR-G9004 Series1.0 – 3.12.1–CNA
EDR-G9010 Series1.0 – 3.12.1–CNA
EDF-G1002-BP Series1.0 – 3.12.1–CNA
NAT-102 Series1.0 – 1.0.5–CNA
OnCell G4302-LTE4 Series1.0 – 3.9–CNA
TN-4900 Series1.0 – 3.6–CNA
EDS-608 Series1.0 – 3.12–CNA
EDS-611 Series1.0 – 3.12–CNA
EDS-616 Series1.0 – 3.12–CNA
EDS-619 Series1.0 – 3.12–CNA
EDS-405A Series1.0 – 3.14–CNA

Scores by source

Moxa (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Moxa (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorymoxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliancesadvisorymoxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches