CVE-2024-9137 - Moxa Service Missing Authentication for Critical Function

Back Back to CVE browser

HIGH

Moxa Service Missing Authentication for Critical Function

Published Oct 14, 2024

8.8

HIGH

CVSS 4.0

EPSS 0.50%

Description

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.

Affected products

Vendor Moxa Product EDF-G1002-BP Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product EDR-8010 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product EDR-G9004 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product EDR-G9010 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product EDS-405A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.14
- Version
  3.14.4
  Status
  unaffected
  Constraints
  -
Vendor Moxa Product EDS-408A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
- Version
  3.14.6
  Status
  unaffected
  Constraints
  -
Vendor Moxa Product EDS-505A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product EDS-508A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product EDS-510A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
Vendor Moxa Product EDS-510E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.5
Vendor Moxa Product EDS-516A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product EDS-518A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product EDS-518E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.3
Vendor Moxa Product EDS-528E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.3
Vendor Moxa Product EDS-608 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
Vendor Moxa Product EDS-611 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
Vendor Moxa Product EDS-616 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
Vendor Moxa Product EDS-619 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12
Vendor Moxa Product EDS-G508E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.4
Vendor Moxa Product EDS-G509 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.10
Vendor Moxa Product EDS-G512E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.4
Vendor Moxa Product EDS-G516E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.4
Vendor Moxa Product EDS-P506E Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.8
Vendor Moxa Product EDS-P510 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product EDS-P510A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.11
Vendor Moxa Product ICS-G7526A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product ICS-G7528A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product ICS-G7748A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product ICS-G7750A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product ICS-G7752A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product ICS-G7826A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product ICS-G7828A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product ICS-G7848A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product ICS-G7850A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product ICS-G7852A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product IKS-6726A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product IKS-6728A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.9
Vendor Moxa Product IKS-G6524A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product IKS-G6824A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.10
Vendor Moxa Product NAT-102 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=1.0.5
Vendor Moxa Product OnCell G4302-LTE4 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.9
Vendor Moxa Product PT-7728 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.9
Vendor Moxa Product PT-7828 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=4.0
Vendor Moxa Product PT-G503 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.3
Vendor Moxa Product PT-G510 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.5
Vendor Moxa Product PT-G7728 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.4
Vendor Moxa Product PT-G7828 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=6.4
Vendor Moxa Product SDS-3006 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-3008 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-3010 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-3016 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-G3006 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-G3008 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-G3010 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product SDS-G3016 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.0
Vendor Moxa Product TN-4500A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.13
Vendor Moxa Product TN-4900 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.6
Vendor Moxa Product TN-5500A Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=3.13
Vendor Moxa Product TN-G4500 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.5
Vendor Moxa Product TN-G6500 Series Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=5.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Moxa

EDF-G1002-BP Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

EDR-8010 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

EDR-G9004 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

EDR-G9010 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

EDS-405A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.14
3.14.4	unaffected	-

Moxa

EDS-408A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12
3.14.6	unaffected	-

Moxa

EDS-505A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

EDS-508A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

EDS-510A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12

Moxa

EDS-510E Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.5

Moxa

EDS-516A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

EDS-518A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

EDS-518E Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.3

Moxa

EDS-528E Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.3

Moxa

EDS-608 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12

Moxa

EDS-611 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12

Moxa

EDS-616 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12

Moxa

EDS-619 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.12

Moxa

EDS-G508E Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.4

Moxa

EDS-G509 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.10

Moxa

EDS-G512E Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.4

Moxa

EDS-G516E Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.4

Moxa

EDS-P506E Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.8

Moxa

EDS-P510 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

EDS-P510A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.11

Moxa

ICS-G7526A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

ICS-G7528A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

ICS-G7748A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

ICS-G7750A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

ICS-G7752A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

ICS-G7826A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

ICS-G7828A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

ICS-G7848A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

ICS-G7850A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

ICS-G7852A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

IKS-6726A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

IKS-6728A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.9

Moxa

IKS-G6524A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

IKS-G6824A Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.10

Moxa

NAT-102 Series

unaffected

Version	Status	Constraints
1.0	affected	<=1.0.5

Moxa

OnCell G4302-LTE4 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.9

Moxa

PT-7728 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.9

Moxa

PT-7828 Series

unaffected

Version	Status	Constraints
1.0	affected	<=4.0

Moxa

PT-G503 Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.3

Moxa

PT-G510 Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.5

Moxa

PT-G7728 Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.4

Moxa

PT-G7828 Series

unaffected

Version	Status	Constraints
1.0	affected	<=6.4

Moxa

SDS-3006 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-3008 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-3010 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-3016 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-G3006 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-G3008 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-G3010 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

SDS-G3016 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.0

Moxa

TN-4500A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.13

Moxa

TN-4900 Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.6

Moxa

TN-5500A Series

unaffected

Version	Status	Constraints
1.0	affected	<=3.13

Moxa

TN-G4500 Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.5

Moxa

TN-G6500 Series

unaffected

Version	Status	Constraints
1.0	affected	<=5.5

Vendor Moxa Product Edf-G1002-BP Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product Edr-G9004 Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product Edr-G9010 Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
Vendor Moxa Product Nat-102 Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=1.0.5
Vendor Moxa Product Oncell G4302-Lte4 Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=3.9
Vendor Moxa Product n/a Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  <=3.12.1
- Version
  1.0
  Status
  affected
  Constraints
  <=3.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Moxa

Edf-G1002-BP

n/a

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

Edr-G9004

n/a

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

Edr-G9010

n/a

Version	Status	Constraints
1.0	affected	<=3.12.1

Moxa

Nat-102

n/a

Version	Status	Constraints
1.0	affected	<=1.0.5

Moxa

Oncell G4302-Lte4

n/a

Version	Status	Constraints
1.0	affected	<=3.9

Moxa

n/a

Version	Status	Constraints
1.0	affected	<=3.12.1
1.0	affected	<=3.6

Remediation

Vendor solution

Please refer to the security advisories: * Missing Authentication and OS Command Injection Vulnerabilities in Cellular Routers, Secure Routers, and Network Security Appliances https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances

* CVE-2024-9137: Missing Authentication Vulnerability in Ethernet Switches https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50423		Advisory
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances		vendor-advisory
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches		vendor-advisory