Moxa issues alert on High-Severity Router Vulnerabilities

Taiwan-based Moxa has issued a security warning regarding two significant vulnerabilities in its cellular routers, secure routers, and network security appliances. These flaws, if exploited, could lead to privilege escalation and unauthorized command execution, posing a serious threat to users’ systems.

Vulnerabilities Overview

1. CVE-2024-9138 (CVSS 4.0 score: 8.6)
   • A hard-coded credentials vulnerability that allows authenticated users to escalate privileges and gain root-level access, potentially compromising the system, exposing data, or causing service disruptions.
2. CVE-2024-9140 (CVSS 4.0 score: 9.3)
   • A command execution vulnerability that enables attackers to bypass input restrictions by exploiting special characters, which could lead to unauthorized command execution.

Impacted Products and Firmware Versions

Both vulnerabilities affect the following Moxa products and firmware versions:

• CVE-2024-9138:
  • EDR-810 Series (Firmware version 5.12.37 and earlier)
  • EDR-8010 Series (Firmware version 3.13.1 and earlier)
  • EDR-G902 Series (Firmware version 5.7.25 and earlier)
  • EDR-G9004 Series (Firmware version 3.13.1 and earlier)
  • EDR-G9010 Series (Firmware version 3.13.1 and earlier)
  • EDF-G1002-BP Series (Firmware version 3.13.1 and earlier)
  • NAT-102 Series (Firmware version 1.0.5 and earlier)
  • OnCell G4302-LTE4 Series (Firmware version 3.13 and earlier)
  • TN-4900 Series (Firmware version 3.13 and earlier)
• CVE-2024-9140:
  • EDR-8010 Series (Firmware version 3.13.1 and earlier)
  • EDR-G9004 Series (Firmware version 3.13.1 and earlier)
  • EDR-G9010 Series (Firmware version 3.13.1 and earlier)
  • EDF-G1002-BP Series (Firmware version 3.13.1 and earlier)
  • NAT-102 Series (Firmware version 1.0.5 and earlier)
  • OnCell G4302-LTE4 Series (Firmware version 3.13 and earlier)
  • TN-4900 Series (Firmware version 3.13 and earlier)

Patch Information

Patches are available for several affected devices:

• EDR-810 Series: Upgrade to firmware version 3.14 or later
• EDR-8010 Series: Upgrade to firmware version 3.14 or later
• EDR-G902 Series: Upgrade to firmware version 3.14 or later
• EDR-G903 Series: Upgrade to firmware version 3.14 or later
• EDR-G9004 Series: Upgrade to firmware version 3.14 or later
• EDR-G9010 Series: Upgrade to firmware version 3.14 or later
• EDF-G1002-BP Series: Upgrade to firmware version 3.14 or later
• NAT-102 Series: No official patch available
• OnCell G4302-LTE4 Series: Contact Moxa Technical Support
• TN-4900 Series: Contact Moxa Technical Support

Mitigation Recommendations

To reduce the risk of exploitation, Moxa advises the following:

• Ensure devices are not exposed to the internet.
• Limit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers.
• Implement measures to detect and prevent exploitation attempts.

These steps can help protect against potential attacks while users await official patches or support from Moxa.