Vulnerabilities fixed in Moxa's cellular routers and network security devices

Moxa has fixed vulnerabilities in Moxa's cellular routers and network security devices Specifically, CVE-2024-9138 and CVE-2024-9140. Vulnerability CVE-2024-9138 involves hard-coded credentials that allow authenticated users to escalate their privileges, ultimately leading to root access. This...

[SECURITY] Fedora 40 Update: ofono-2.14-1.fc40

oFono.org is a place to bring developers together around designing an infrastructure for building mobile telephony GSM/UMTS applications. oFono includes a high-level D-Bus API for use by telephony applications. oFono also includes a low-level plug-in API for integrating with telephony stacks,...

CVE-2024-9140: Improper Neutralization of Special Elements used in an OS Command

Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code. This poses a significan...

CVE-2024-9138: Reliance on Security Through Obscurity

Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a...

Quectel EC25-EUX 安全漏洞

The Quectel EC25-EUX is a series of LTE Cat 4 IoT modules with LCC form factor from Quectel. A security vulnerability exists in the Quectel EC25-EUX that stems from the inclusion of a buffer overflow vulnerability...

CVE-2024-24452

An invalid memory access when handling the ProtocolIEID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24455

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24454

An invalid memory access when handling the ProtocolIEID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24457

An invalid memory access when handling the ProtocolIEID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24455

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24459

An invalid memory access when handling the ProtocolIEID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24452

The HPE Athonet vEPC MME v11.4.0 is vulnerable to an out-of-bounds read (CWE-125) caused by invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages. An attacker can exploit this by repeatedly initiating connections and sending a crafted payload to cause a ...

CVE-2024-24452: Out-of-bounds Read

An invalid memory access when handling the ProtocolIEID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24457: Out-of-bounds Read

An invalid memory access when handling the ProtocolIEID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24454

An invalid memory access when handling the ProtocolIEID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24453

An invalid memory access when handling the ProtocolIEID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24455

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24454

An invalid memory access when handling the ProtocolIEID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-24454

CVE-2024-24454 affects Hewlett Packard Enterprise Athonet vEPC MME v11.4.0. The vulnerability is an invalid memory access in the handling of ProtocolIE_ID in E-RAB Modify Request messages, which can allow an attacker to cause a Denial of Service to the cellular network by repeatedly initiating co...

CVE-2024-24453

CVE-2024-24453 affects Hewlett Packard Enterprise Athonet vEPC MME 11.4.0. The vulnerability is an invalid memory access when handling the ProtocolIE_ID field of the E-RAB NotToBeModifiedBearerModInd information element, which can be exploited to cause a DoS on the cellular network by repeatedly ...