Moxa, a leading industrial networking solutions provider, has disclosed two significant security vulnerabilities affecting their cellular routers, secure routers, and network security appliances. These devices are widely deployed in critical infrastructure sectors including transportation, utilities, energy, and telecommunications.

Security Vulnerabilities:
– CVE-2024-9138 (High Severity – 8.6): Enables privilege escalation to root access through hard-coded credentials
– CVE-2024-9140 (Critical Severity – 9.3): Allows remote attackers to execute arbitrary code through OS command injection

Affected Devices:
Primary Impact (Both Vulnerabilities):
– EDR-8010 Series
– EDR-G9004 Series
– EDR-G9010 Series
– EDF-G1002-BP Series
– NAT-102 Series
– OnCell G4302-LTE4 Series
– TN-4900 Series

Secondary Impact (CVE-2024-9138 Only):
– EDR-810 Series
– EDR-G902 Series

Remediation Steps:
1. Most affected devices should upgrade to firmware version 3.14
2. OnCell G4302-LTE4 and TN-4900 users should contact Moxa support
3. NAT-102 Series users should implement recommended mitigations:
– Limit network exposure
– Restrict SSH access
– Deploy firewalls and IPS/IDS systems

Moxa emphasizes immediate action to prevent potential exploitation of these vulnerabilities. The MRC-1002 Series, TN-5900 Series, and OnCell 3120-LTE-1 Series remain unaffected by these security issues.