Second Order Command-injection Vulnerability in the Certificate-delete Function

Vulnerability

The command-injection vulnerability exists in the certificate-delete function of TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior [1]. The root cause is insufficient input validation, which allows an attacker to inject arbitrary OS commands when deleting a certificate.

Exploitation

To exploit this vulnerability, an attacker needs authenticated access to the web interface of an affected device [1]. The attacker can craft a malicious certificate deletion request containing injected commands. No user interaction beyond the attacker's own actions is required.

Impact

Successful exploitation allows the attacker to delete arbitrary files on the device [1]. This can lead to denial of service or disruption of device functionality, potentially affecting network operations.

Mitigation

Moxa has developed firmware solutions; users should upgrade TN-4900 Series to a fixed version beyond v1.2.4 and TN-5900 Series beyond v3.3 [1]. As a workaround, minimize network exposure and use VPNs for remote access [1]. The vulnerability is not listed in CISA KEV as of the advisory date.