Riskcovery

CVE-2024-9137

Moxa Service Missing Authentication for Critical Function

State
Published
Severity
8.8 High
Published
Oct 14, 2024
Updated
Sep 19, 2025
Reserved
Sep 24, 2024

Read the record on cve.org

Description

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.

Scores

CVSSScoreVectorSource
4.08.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:NMoxa
3.19.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HMoxa

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
EDR-8010 SeriesMoxa
  • 1.0 through 3.12.1Affected
EDR-G9004 SeriesMoxa
  • 1.0 through 3.12.1Affected
EDR-G9010 SeriesMoxa
  • 1.0 through 3.12.1Affected
EDF-G1002-BP SeriesMoxa
  • 1.0 through 3.12.1Affected
NAT-102 SeriesMoxa
  • 1.0 through 1.0.5Affected
OnCell G4302-LTE4 SeriesMoxa
  • 1.0 through 3.9Affected
TN-4900 SeriesMoxa
  • 1.0 through 3.6Affected
EDS-608 SeriesMoxa
  • 1.0 through 3.12Affected
EDS-611 SeriesMoxa
  • 1.0 through 3.12Affected
EDS-616 SeriesMoxa
  • 1.0 through 3.12Affected
EDS-619 SeriesMoxa
  • 1.0 through 3.12Affected
EDS-405A SeriesMoxa
  • 1.0 through 3.14Affected
  • 3.14.4Not affected
EDS-408A SeriesMoxa
  • 1.0 through 3.12Affected
  • 3.14.6Not affected
EDS-505A SeriesMoxa
  • 1.0 through 3.11Affected
EDS-508A SeriesMoxa
  • 1.0 through 3.11Affected
EDS-510A SeriesMoxa
  • 1.0 through 3.12Affected
EDS-516A SeriesMoxa
  • 1.0 through 3.11Affected
EDS-518A SeriesMoxa
  • 1.0 through 3.11Affected
EDS-G509 SeriesMoxa
  • 1.0 through 3.10Affected
EDS-P510 SeriesMoxa
  • 1.0 through 3.11Affected
EDS-P510A SeriesMoxa
  • 1.0 through 3.11Affected
EDS-510E SeriesMoxa
  • 1.0 through 5.5Affected
EDS-518E SeriesMoxa
  • 1.0 through 6.3Affected
EDS-528E SeriesMoxa
  • 1.0 through 6.3Affected
EDS-G508E SeriesMoxa
  • 1.0 through 6.4Affected
EDS-G512E SeriesMoxa
  • 1.0 through 6.4Affected
EDS-G516E SeriesMoxa
  • 1.0 through 6.4Affected
EDS-P506E SeriesMoxa
  • 1.0 through 5.8Affected
ICS-G7526A SeriesMoxa
  • 1.0 through 5.10Affected
ICS-G7528A SeriesMoxa
  • 1.0 through 5.10Affected
ICS-G7748A SeriesMoxa
  • 1.0 through 5.9Affected
ICS-G7750A SeriesMoxa
  • 1.0 through 5.9Affected
ICS-G7752A SeriesMoxa
  • 1.0 through 5.9Affected
ICS-G7826A SeriesMoxa
  • 1.0 through 5.10Affected
ICS-G7828A SeriesMoxa
  • 1.0 through 5.10Affected
ICS-G7848A SeriesMoxa
  • 1.0 through 5.9Affected
ICS-G7850A SeriesMoxa
  • 1.0 through 5.9Affected
ICS-G7852A SeriesMoxa
  • 1.0 through 5.9Affected
IKS-G6524A SeriesMoxa
  • 1.0 through 5.10Affected
IKS-6726A SeriesMoxa
  • 1.0 through 5.9Affected
IKS-6728A SeriesMoxa
  • 1.0 through 5.9Affected
IKS-G6824A SeriesMoxa
  • 1.0 through 5.10Affected
SDS-3006 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-3008 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-3010 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-3016 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-G3006 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-G3008 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-G3010 SeriesMoxa
  • 1.0 through 3.0Affected
SDS-G3016 SeriesMoxa
  • 1.0 through 3.0Affected
PT-7728 SeriesMoxa
  • 1.0 through 3.9Affected
PT-7828 SeriesMoxa
  • 1.0 through 4.0Affected
PT-G503 SeriesMoxa
  • 1.0 through 5.3Affected
PT-G510 SeriesMoxa
  • 1.0 through 6.5Affected
PT-G7728 SeriesMoxa
  • 1.0 through 6.4Affected
PT-G7828 SeriesMoxa
  • 1.0 through 6.4Affected
TN-4500A SeriesMoxa
  • 1.0 through 3.13Affected
TN-5500A SeriesMoxa
  • 1.0 through 3.13Affected
TN-G4500 SeriesMoxa
  • 1.0 through 5.5Affected
TN-G6500 SeriesMoxa
  • 1.0 through 5.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.