Second Order Command-injection Vulnerability in the Key-delete Function

Vulnerability

A command-injection vulnerability exists in the key-delete function of Moxa TN-4900 Series firmware versions v1.2.4 and prior, and TN-5900 Series firmware versions v3.3 and prior. The flaw arises from insufficient input validation, enabling attackers to inject operating system commands. The affected product series are explicitly listed in the advisory [1].

Exploitation

An attacker can exploit this vulnerability without authentication by sending crafted input to the key-delete function over the network. No special privileges or user interaction are required. The advisory notes the vulnerability is accessible through the web server interface, allowing remote exploitation [1].

Impact

Successful exploitation allows an attacker to delete arbitrary files on the device. This can lead to denial of service or disruption of critical system operations. The vulnerability affects the confidentiality, integrity, and availability of the device [1].

Mitigation

Moxa has released firmware updates to address the vulnerability. Affected users should update TN-4900 Series to firmware version v1.2.5 or later, and TN-5900 Series to firmware version v3.4 or later. Until patching is possible, Moxa recommends minimizing network exposure and using VPNs for remote access [1].