Moxa MAR-2000 firmware ping condition allows command injection
Original title: [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2)
A saved monitoring field is reused by a scheduled ping thread for recurring command execution.
0day Rubbish Research Team publicly disclosed a command-injection flaw in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware FWR_MAR2000_V1.0_Build_15010909. An authenticated administrator can store a monitoring-condition field that the scenario ping thread later builds into a command line and executes on a product schedule. The team rates it 7.2. No fix is stated.
Unconfirmed: The snippet does not state a patch, CVE, or confirmed exploitation.
- The affected image is FWR_MAR2000_V1.0_Build_15010909.
- The flaw requires an authenticated administrator.
- Execution is recurring through the auto-executing ping thread.
- The product is an industrial 4G/LTE cellular router.
Impact: authenticated administrator command execution on a schedule
| Product | Affected |
|---|---|
| Moxa MAR-2000 | FWR_MAR2000_V1.0_Build_15010909 |
- Vendors
- Moxa
- Products
- MAR-2000
- Organizations
- 0day Rubbish Research Team
- Countries
- Taiwan
From the original article
Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1. 0_Build_15010909, from Moxa Inc. (Taiwan).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.