Command-injection Vulnerability in Certificate Management

Vulnerability

A command injection vulnerability exists in the certificate management function of Moxa TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior [1]. The issue stems from inadequate input validation, allowing an attacker to inject arbitrary OS commands via crafted input to the certificate management interface [1]. The affected products also include EDR-810, EDR-G902, EDR-G903, EDR-G9010, and NAT-102 series running affected firmware versions [1].

Exploitation

An attacker must have network access to the affected device's web server and be able to reach the certificate management function [1]. No prior authentication is explicitly required; the vulnerability can be triggered by sending specially crafted requests to the certificate management endpoint [1]. The attacker injects commands through input fields that are not properly sanitized, leading to command execution [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device with the privileges of the web server process [1]. This can lead to full compromise of the device, including data exfiltration, configuration manipulation, or further lateral movement within the network [1].

Mitigation

Moxa has released firmware updates to address the vulnerability: TN-5900 Series firmware v3.4 and later, TN-4900 Series firmware v1.3.0 and later, and similar updates for other affected product series [1]. Users should apply the latest firmware from Moxa's support site [1]. Mitigation includes minimizing network exposure and using VPNs for remote access [1].