Vulnerabilities in Moxa EDR-810 routers

Multiple vulnerabilities have been identified in Moxa EDR-810 industrial routers. Their successful exploitation could lead to privilege escalation and denial-of-service conditions.

According to a Cisco Talos advisory, a total of 17 flaws having different severity levels have been identified in the device that has firmware v 4.1. Seven of these flaws are command injection and cross-site request forgery (CSRF) vulnerabilities of the web server functionality: by sending specially crafted HTTP packets (CVE-2017-12126) or POST requests (CVE-2017-12121, CVE-2017-12120, CVE-2017-12125, CVE-2017-14432 – CVE-2017-14434) to the target device, an attacker can achieve escalation of privilege and gain superuser privileges on the system.

By exploiting vulnerabilities of the device’s web server functionality, an attacker can also cause a denial-of-service condition (CVE-2017-12124, CVE-2017-14435 – CVE-2017-14437).

Other issues include plaintext password transmission or storage (CVE-2017-12123, CVE-2017-12127), weak cryptography for passwords (CVE-2017-12129), and vulnerabilities that have to do with information disclosure (CVE-2017-12128) and Service Agent functionality (CVE-2017-14438 – CVE-2017-14439).

All of the above vulnerabilities were corrected by the vendor in firmware v. 4.2.

Source: Cisco Talos