What’s Vulnerable › Vulnerabilities

CVE-2024-9137: Moxa Service Missing Authentication for Critical Function

• Severity: critical (CVSS 9.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-14 · updated 2026-06-17
• Weakness: CWE-306

Description

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.

Affected products

• Moxa Edf-G1002-Bp: from 1.0 through 3.12.1
• Moxa Edr-8010: from 1.0 through 3.12.1
• Moxa Edr-G9004: from 1.0 through 3.12.1
• Moxa Edr-G9010: from 1.0 through 3.12.1
• Moxa Nat-102: from 1.0 through 1.0.5
• Moxa Oncell G4302-Lte4: from 1.0 through 3.9
• Moxa Tn-4900: from 1.0 through 3.6

References

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances
• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches

Get alerted when CVE-2024-9137 or the next vulnerability affects your stack