Moxa TN-4900 up to 5.12.37 reliance on security through obscurity

Summaryinfo

A vulnerability was found in Moxa EDR-810, EDR-8010, EDR-G902, EDR-G903, EDR-G9004, EDR-G9010, EDF-G1002-BP, NAT-102, OnCell G4302-LTE4 and TN-4900 up to 5.12.37. It has been rated as very critical. This issue affects some unknown processing. The manipulation leads to reliance on security through obscurity. This vulnerability is traded as CVE-2024-9138. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Moxa EDR-810, EDR-8010, EDR-G902, EDR-G903, EDR-G9004, EDR-G9010, EDF-G1002-BP, NAT-102, OnCell G4302-LTE4 and TN-4900 up to 5.12.37 and classified as very critical. This issue affects an unknown function. The manipulation with an unknown input leads to a reliance on security through obscurity vulnerability. Using CWE to declare the problem leads to CWE-656. The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk.

The weakness was shared by Lars Haulin. The advisory is shared at moxa.com. The identification of this vulnerability is CVE-2024-9138 since 09/24/2024. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/03/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Moxa

Name

• EDF-G1002-BP
• EDR-810
• EDR-8010
• EDR-G902
• EDR-G903
• EDR-G9004
• EDR-G9010
• NAT-102
• OnCell G4302-LTE4
• TN-4900

Version

• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6
• 5.12.7
• 5.12.8
• 5.12.9
• 5.12.10
• 5.12.11
• 5.12.12
• 5.12.13
• 5.12.14
• 5.12.15
• 5.12.16
• 5.12.17
• 5.12.18
• 5.12.19
• 5.12.20
• 5.12.21
• 5.12.22
• 5.12.23
• 5.12.24
• 5.12.25
• 5.12.26
• 5.12.27
• 5.12.28
• 5.12.29
• 5.12.30
• 5.12.31
• 5.12.32
• 5.12.33
• 5.12.34
• 5.12.35
• 5.12.36
• 5.12.37

License

• commercial

Website

• Vendor: https://www.moxa.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion