CVE-2017-14433

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the...

CVE-2017-14432

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0tmp= parameter in the...

CVE-2017-14436

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\CFG2.ini" without a cookie head...

CVE-2017-14438

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp to trigger this vulnerability...

CVE-2017-12128

An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability...

CVE-2017-12125

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the "/goform/netWebCSRGen" uri...

CVE-2017-12123

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

CVE-2017-14438

CVE-2017-14438 affects the Moxa EDR-810 Industrial Secure Router (V4.1, build 17030317). The vulnerability lies in the Service Agent: sending a specially crafted large TCP packet to port 4000 (and 4001) can cause a denial-of-service crash. Talos reports the issue on ports 4000/tcp and 4001/tcp wi...

CVE-2017-12120

CVE-2017-12120 affects Moxa EDR-810 Web Ping functionality in firmware build 17030317. A crafted HTTP POST to /goform/net_WebPingGetValue allows OS command injection via the ip= parameter, enabling privilege escalation to a root shell. Affected product is the Moxa EDR-810; impact includes potenti...

CVE-2017-14434

Summary: CVE-2017-14434 affects Moxa EDR-810 Web Server (V4.1 build 17030317). The vulnerability is a command injection in the web server’s OpenVPN config endpoint, exploitable after logging in via HTTP POST to /goform/net_Web_get_value, specifically through the remoteNetmask0 parameter, allowing...

CVE-2017-14432

CVE-2017-14432 affects Moxa EDR-810 (V4.1, build 17030317). The web server allows command injection via POST to /goform/net_Web_get_value, injecting commands into openvpnServer0_tmp= and escalating privileges to root after authentication. Talos notes four related CVEs culminated in root-shell acc...

CVE-2017-14437

CVE-2017-14437 affects Moxa EDR-810 Web Server (V4.1, build 17030317). A denial-of-service is exploitable by sending a crafted HTTP GET to endpoints such as "/MOXA_LOG.ini" (and related variants), triggering a null pointer dereference without a cookie header. Talos confirms multiple related DO vu...

CVE-2017-14436

CVE-2017-14436 affects Moxa EDR-810, firmware version 4.1 build 17030317. A denial of service can be triggered by a crafted HTTP GET request to /MOXA_CFG2.ini without a cookie header, causing a null pointer dereference in the web server. Exploitation is network-based and requires no authenticatio...

CVE-2017-12121

The CVE-2017-12121 issue affects Moxa EDR-810 Web RSA Key Generation functionality. Talos reports a command-injection in the rsakey_name parameter of the /goform/WebRSAKEYGen POST, enabling privilege escalation to root when authenticated. A root shell can be obtained via crafted input; affected p...

CVE-2017-12128

CVE-2017-12128 affects Moxa EDR-810, specifically the Server Agent in version 4.1 build 17030317. A crafted TCP packet (0x21) over TCP/4000 can trigger an information-disclosure vulnerability, exposing device data (model, firmware, serial, location, MAC, IP mask, etc.). Public writeups from Talos...

CVE-2017-12126

CVE-2017-12126 is a CSRF vulnerability in the web server of the Moxa EDR-810 (V4.1, build 17030317). A specially crafted HTTP request can trigger cross-site request forgery, potentially changing device configuration when a logged-in user visits a malicious page. The exploitation details are docum...

CVE-2017-14439

CVE-2017-14439 affects Moxa EDR-810 with the Service Agent (V4.1, build 17030317). A crafted packet to ports 4000/4001 can trigger a denial-of-service. Talos/Tenable/NVD describe exploitable DoS with CVSSv3 base 7.5 (NETWORK, LOW attack complexity, no auth, Availability Impact HIGH). The Service ...

CVE-2017-12124

CVE-2017-12124 affects Moxa EDR-810 Web Server (V4.1, build 17030317). A crafted HTTP URI can trigger a null pointer dereference in the web server, causing a crash and denial of service. Talos notes the issue in the web server functionality and provides timeline of vendor fixes with updated firmw...

CVE-2017-12129

An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them...

CVE-2017-14434

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetmask0= parameter in the...