Second Order Command-injection Vulnerability in the Key-generation Function

Vulnerability

The command injection vulnerability resides in the key-generation function of the web server on Moxa TN-4900 Series (firmware version v1.2.4 and prior) and TN-5900 Series (firmware version v3.3 and prior) [1]. Insufficient input validation in this function allows an attacker to inject arbitrary operating system commands. The code path is reachable through the web interface without requiring authentication.

Exploitation

An attacker with network access to the affected device's web server can send a specially crafted request to the key-generation endpoint. No prior authentication or user interaction is required. The injected commands are executed with the privileges of the web server process.

Impact

Successful exploitation results in remote code execution on the device. The attacker can execute arbitrary commands, potentially leading to full compromise of the device, including data exfiltration, installation of malware, or disruption of operations.

Mitigation

As of the advisory publication date, Moxa has not released a firmware patch for this vulnerability [1]. Recommended mitigations include minimizing network exposure of the device and using VPNs for remote access [1]. Users should monitor Moxa's security advisory for future firmware updates.