As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.

Product support

Security Advisories

SUMMARY

CVE-2024-9404: Denial-of-Service Vulnerability Identified in Multiple EDS, ICS, IKS, and SDS Switches

  • Security Advisory ID: MPSA-240931
  • Version: V1.2
  • Release Date: Feb 07, 2025
  • Reference:

    CVE-2024-9404 (Moxa) 

Multiple Moxa EDS, ICS, IKS, and SDS switches are affected by a high-severity vulnerability, CVE-2024-9404, which could lead to a denial-of-service condition or cause a system or service crash. This vulnerability allows attackers to exploit the Moxa service, commonly referred to as moxa_cmd, originally designed for deployment purposes. Due to insufficient input validation, this service can be exploited to trigger a cold start or denial-of-service condition.

This vulnerability poses a significant remote threat if the affected products are exposed to publicly accessible networks. Attackers could potentially disrupt operations by shutting down the affected systems. Due to the critical nature of this security risk, we strongly recommend taking immediate action to prevent its potential exploitation. 

The Identified Vulnerability Type and Potential Impact 

Vulnerability Scoring Details 

Note: This advisory uses CVSS 3.1 as the standard for determining severity levels. CVSS 4.0 is provided as a reference metric for comparison. 

AFFECTED PRODUCTS AND SOLUTIONS

Affected Products

Products Affected by CVE-2024-9404

Affected products and their firmware versions are listed in the following table: 

 

Solutions

Moxa has developed appropriate solutions to address vulnerability. The solutions for the affected products are listed in the following table:

 

Mitigations

To mitigate the risks associated with this vulnerability, we recommend the following actions: 

  • Disable Moxa Service and Moxa Service (Encrypted) temporarily if they are not required for operations. This will minimize potential attack vectors until a patch or updated firmware is applied. 

Refer to the General Security Recommendations section to further strengthen your security posture. 

 

General Security Recommendations

To safeguard devices and networks, we recommend implementing the following recommendations to mitigate potential risks:

  1. Restrict Network Access
    • Use firewalls or access control lists (ACLs) to limit communication to trusted IP addresses and networks.
    • Segregate operational networks from other networks (e.g., enterprise networks) using VLANs or physical separation.
  2. Minimize Exposure
    • Avoid exposing devices directly to the Internet.
    • Disable unused network services and ports to reduce the attack surface.
  3. Enhance Device Authentication and Access Control
    • Implement multi-factor authentication (MFA) for accessing critical systems.
    • Use role-based access control (RBAC) to enforce the principle of least privilege.
  4. Regularly Update Firmware and Software
    • Keep devices updated with the latest firmware versions and security patches.
    • Establish a regular patch management schedule to address newly identified vulnerabilities.
  5. Secure Remote Access
    • Use encrypted communication protocols (e.g., VPN, SSH) for remote access.
    • Restrict remote access to authorized personnel only and enforce strong authentication mechanisms.
  6. Implement Anomaly Detection Techniques
    • Monitor network traffic and device behavior for unusual or unauthorized activities.
    • Use tools or techniques that can identify anomalies and provide alerts for potential threats.
  7. Implement Logging and Monitoring
    • Enable event logging and maintain audit trails on devices.
    • Regularly review logs for anomalies and unauthorized access attempts.
  8. Conduct Regular Security Assessments
    • Perform vulnerability assessments to identify potential risks.
    • Regularly review device configurations to ensure compliance with security policies.

 

Acknowledgement

We would like to express our gratitude to YU-HSIANG HUANG (huang.yuhsiang.phone@gmail.com) from Moxa's cybersecurity technology team for reporting the vulnerability, collaborating with us to enhance the security of our products, and contributing to our efforts to deliver better service to our customers.

 

Revision History:

Relevant Products

EDS-405A Series · EDS-408A Series · EDS-505A Series · EDS-508A Series · EDS-510A Series · EDS-510E Series · EDS-516A Series · EDS-518A Series · EDS-518E Series · EDS-528E Series · EDS-608 Series · EDS-611 Series · EDS-616 Series · EDS-619 Series · EDS-G508E Series · EDS-G509 Series · EDS-G512E Series · EDS-G516E Series · EDS-P506E Series · EDS-P510 Series · EDS-P510A Series · ICS-G7526A Series · ICS-G7528A Series · ICS-G7748A Series · ICS-G7750A Series · ICS-G7752A Series · ICS-G7826A Series · ICS-G7828A Series · ICS-G7848A Series · ICS-G7850A Series · ICS-G7852A Series · IKS-6726A Series · IKS-6728A Series · IKS-G6524A Series · IKS-G6824A Series · SDS-3006 Series · SDS-3008 Series · SDS-3010 Series · SDS-3016 Series · SDS-G3006 Series · SDS-G3008 Series · SDS-G3010 Series · SDS-G3016 Series ·

  •   Print this page
  • You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
Added To Bag
You have some items waiting in your bag; click here to finish your quote!
Feedback
COOKIE PREFERENCES