Web Server Buffer Overflow Vulnerability

Vulnerability

A buffer overflow vulnerability (CWE-120) exists in the web server of Moxa EDR-810, EDR-G902, and EDR-G903 Series routers. The insufficient input validation in the URI allows an attacker to trigger a denial-of-service condition by causing the device to reboot. Affected firmware versions are EDR-810 Series v5.12.28 and prior, and EDR-G902/G903 Series v5.7.20 and prior [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attacker sends a specially crafted HTTP request with a malicious URI to the target device's web server, triggering the buffer overflow and causing the device to reboot [1].

Impact

Successful exploitation results in a denial-of-service (DoS) condition as the device reboots. While no data confidentiality is compromised, the attacker achieves a low integrity impact (device reset) and low availability impact (temporary service disruption) [1].

Mitigation

Moxa has developed firmware updates to address this vulnerability; refer to the security advisory [1] for the specific fixed versions. As a workaround, minimize network exposure and ensure the device is not accessible from the Internet. If remote access is required, use secure methods such as VPNs [1].