Second Order Command-injection Vulnerability in the Key-generation Function
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
TN-5900 Series
Vendor
Moxa
Product
TN-5900 Series
Platforms
Unknown
Default status
unaffected
TN-5900 Series · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.0
affected
custom
Unavailable
3.3
None listed
TN-4900 Series
Vendor
Moxa
Product
TN-4900 Series
Platforms
Unknown
Default status
unaffected
TN-4900 Series · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.0
affected
custom
Unavailable
1.2.4
None listed
EDR-810 Series
Vendor
Moxa
Product
EDR-810 Series
Platforms
Unknown
Default status
unaffected
EDR-810 Series · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.0
affected
custom
Unavailable
5.12.27
None listed
EDR-G902 Series
Vendor
Moxa
Product
EDR-G902 Series
Platforms
Unknown
Default status
unaffected
EDR-G902 Series · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.0
affected
custom
Unavailable
5.7.17
None listed
EDR-G903 Series
Vendor
Moxa
Product
EDR-G903 Series
Platforms
Unknown
Default status
unaffected
EDR-G903 Series · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.0
affected
custom
Unavailable
5.7.15
None listed
EDR-G9010 Series
Vendor
Moxa
Product
EDR-G9010 Series
Platforms
Unknown
Default status
unaffected
EDR-G9010 Series · Scoped product and version facts