Auth bypass in Moxa Edf-G1002-Bp Series
CVE-2024-9137
The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (41.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Moxa Edf-G1002-Bp Series — versions 1.0
- Moxa Edr-8010 Series — versions 1.0
- Moxa Edr-G9004 Series — versions 1.0
- Moxa Edr-G9010 Series — versions 1.0
- Moxa Eds-405a Series — versions 1.0, 3.14.4
- Moxa Eds-408a Series — versions 1.0, 3.14.6
- Moxa Eds-505a Series — versions 1.0
- Moxa Eds-508a Series — versions 1.0
- Moxa Eds-510a Series — versions 1.0
- Moxa Eds-510e Series — versions 1.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-9137?
- CVE-2024-9137 is a critical-severity vulnerability in Moxa Edf-G1002-Bp Series, classified under Missing Authentication for Critical Function. CVSS score: 9.4/10. Published 2024-10-14.
- How severe is CVE-2024-9137?
- Critical severity. CVSS v3 base score is 9.4 out of 10.