SB2020110310 - Multiple vulnerabilities in Moxa EDR-810 Series

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Command Injection (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted request to the web server and execute arbitrary commands on the target system.

2) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to the web server and perform a denial of service (DoS) attack.

3) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to the device and cause specific parts of the user interface to become unresponsive.

4) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to the device and cause specific parts of the user interface to become unresponsive.

5) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to the device and cause specific parts of the user interface to become unresponsive.

6) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to the device and cause specific parts of the user interface to become unresponsive.

Remediation

Install update from vendor's website.

References

• https://www.moxa.com/en/support/support/security-advisory/edr-810-series-security-router-vulnerabilities