CVE-2024-9139

OS Command Injection in Restricted Command

State: Published
Severity: 8.6 High
Published: Oct 14, 2024
Updated: Nov 6, 2024
Reserved: Sep 24, 2024

Description

The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Moxa
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Moxa

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
EDR-8010 SeriesMoxa	1.0 through 3.12.1Affected
EDR-G9004 SeriesMoxa	1.0 through 3.12.1Affected
EDR-G9010 SeriesMoxa	1.0 through 3.12.1Affected
EDF-G1002-BP SeriesMoxa	1.0 through 3.12.1Affected
NAT-102 SeriesMoxa	1.0 through 1.0.5Affected
OnCell G4302-LTE4 SeriesMoxa	1.0 through 3.9Affected
TN-4900 SeriesMoxa	1.0 through 3.6Affected
EDR-810 SeriesMoxa	1.0 through 5.12.33Affected

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliancesvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.