CVSS: 8.6EPSS: 0%CPEs: 8EXPL: 0CVE-2024-9139 – OS Command Injection in Restricted Command
https://notcve.org/view.php?id=CVE-2024-9139
The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. El producto afectado permite la inyección de comandos del sistema operativo a través de comandos restringidos incorrectamente, lo que potencialmente permite a los atacantes ejecutar código arbitrario. • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2023-4452 – Web Server Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2023-4452
A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to trigger the device reboot. Se ha identificado una vulnerabilidad en Series EDR-810, EDR-G902 y EDR-G903, lo que las hace vulnerables a la vulnerabilidad de denegación de servicio. Esta vulnerabilidad se debe a una validación de entrada insuficiente en el URI, lo que potencialmente permite que usuarios malintencionados activen el reinicio del dispositivo. • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-234880-edr-810-g902-g903-series-web-server-buffer-overflow-vulnerability • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2020-28144
https://notcve.org/view.php?id=CVE-2020-28144
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution. Determinados productos de Moxa Inc están afectados por una restricción inapropiada de operaciones en EDR-G903 Series Versión de Firmware 5.5 o inferiores, EDR-G902 Series Versión de Firmware 5.5 o inferiores, y EDR-810 Series Versión de Firmware 5.6 o inferiores. Unas peticiones diseñadas enviadas al dispositivo pueden permitir una ejecución de código arbitraria remota • https://www.moxa.com/en/support/support/security-advisory/edr-g903-g902-810-secure-router-vulnerability • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2019-10963 – Moxa EDR-810 - Command Injection / Information Disclosure
https://notcve.org/view.php?id=CVE-2019-10963
Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user. Moxa EDR 810, todas las versiones 5.1 y anteriores, permite a un atacante no autenticado poder recuperar algunos archivos de registro del dispositivo, lo que puede permitir la divulgación de información confidencial. Los archivos de registro deben haber sido previamente exportados por un usuario legítimo. Moxa EDR-810 suffers from command injection and information disclosure vulnerabilities. • https://www.exploit-db.com/exploits/47536 http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.html https://www.us-cert.gov/ics/advisories/icsa-19-274-03 • CWE-321: Use of Hard-coded Cryptographic Key •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2019-10969 – Moxa EDR-810 - Command Injection / Information Disclosure
https://notcve.org/view.php?id=CVE-2019-10969
Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may allow an attacker to perform remote code execution. Moxa EDR 810, todas las versiones 5.1 y anteriores, permite a un atacante autenticado abusar de la funcionalidad ping para ejecutar comandos no autorizados en el enrutador, lo que puede permitir a un atacante realizar la ejecución de código remota. Moxa EDR-810 suffers from command injection and information disclosure vulnerabilities. • https://www.exploit-db.com/exploits/47536 http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.html https://www.us-cert.gov/ics/advisories/icsa-19-274-03 • CWE-20: Improper Input Validation •