Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2024-9139
PUBLISHED
More InfoOfficial Page
Assigner-Moxa
Assigner Org ID-2e0a0ee2-d866-482a-9f5e-ac03d156dbaa
View Known Exploited Vulnerability (KEV) details
Published At-14 Oct, 2024 | 08:20
Updated At-06 Nov, 2024 | 20:47
Rejected At-
▼CVE Numbering Authority (CNA)
OS Command Injection in Restricted Command

The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.

Affected Products
Vendor
Moxa Inc.Moxa
Product
EDR-8010 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.Moxa
Product
EDR-G9004 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.Moxa
Product
EDR-G9010 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.Moxa
Product
EDF-G1002-BP Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.Moxa
Product
NAT-102 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 1.0.5 (custom)
Vendor
Moxa Inc.Moxa
Product
OnCell G4302-LTE4 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.9 (custom)
Vendor
Moxa Inc.Moxa
Product
TN-4900 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 3.6 (custom)
Vendor
Moxa Inc.Moxa
Product
EDR-810 Series
Default Status
unaffected
Versions
Affected
  • From 1.0 through 5.12.33 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-78CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Type: CWE
CWE ID: CWE-78
Description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Metrics
VersionBase scoreBase severityVector
4.08.6HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.17.2HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 7.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-88CAPEC-88 OS Command Injection
CAPEC ID: CAPEC-88
Description: CAPEC-88 OS Command Injection
Solutions

Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for the affected products are shown below. * EDR-8010 Series: Upgrade to the firmware version 3.13 or later version. * EDR-G9004 Series: Upgrade to the firmware version 3.13 or later version. * EDR-G9010 Series: Upgrade to the firmware version 3.13 or later version. * EDF-G1002-BP Series: Upgrade to the firmware version 3.13 or later version. * NAT-102 Series: Please contact Moxa Technical Support for the security patch. * OnCell G4302-LTE4 Series: Upgrade to the firmware version 3.13 or later version. * TN-4900 Series: Upgrade to the firmware version 3.13 or later version. * EDR-810 Series: Upgrade to the firmware version 5.12.37 or later version.

Configurations
Workarounds

* Minimize network exposure to ensure the device is not accessible from the Internet. * Limit web access to trusted IP addresses and networks by using firewall rules or TCP wrappers. * Implement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks.

Exploits
Credits
finder
Lars Haulin
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances
vendor-advisory
Hyperlink: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
Moxa Inc.moxa
Product
edr-8010_firmware
CPEs
  • cpe:2.3:o:moxa:edr-8010_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.moxa
Product
edr-g9004_firmware
CPEs
  • cpe:2.3:o:moxa:edr-g9004_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.moxa
Product
edr-g9010_firmware
CPEs
  • cpe:2.3:o:moxa:edr-g9010_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.moxa
Product
edf-g1002-bp_firmware
CPEs
  • cpe:2.3:o:moxa:edf-g1002-bp_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.12.1 (custom)
Vendor
Moxa Inc.moxa
Product
nat-102_firmware
CPEs
  • cpe:2.3:o:moxa:nat-102_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 1.0.5 (custom)
Vendor
Moxa Inc.moxa
Product
oncell_g4302-lte4_firmware
CPEs
  • cpe:2.3:o:moxa:oncell_g4302-lte4_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.9 (custom)
Vendor
Moxa Inc.moxa
Product
tn-4900_firmware
CPEs
  • cpe:2.3:o:moxa:tn-4900_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 3.6 (custom)
Vendor
Moxa Inc.moxa
Product
edr-810_firmware
CPEs
  • cpe:2.3:o:moxa:edr-810_firmware:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 1.0 through 5.12.33 (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found