Moxa MAR-2000 IPsec route commands allow authenticated injection
Original title: [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2)
Firmware FWR_MAR2000_V1.0_Build_15010909 interpolates a stored VPN address into shell commands run as the model process.
0day Rubbish Research Team publicly disclosed a flaw in the Moxa MAR-2000 series industrial 4G/LTE router, firmware image FWR_MAR2000_V1.0_Build_15010909. An authenticated administrator can turn one stored VPN address field into arbitrary command execution as the product's model process. The IPsec model manages tunnel addresses and routes by interpolating that field into route-management shell commands. No CVE or fix is named.
Unconfirmed: The post does not say whether attackers exploit it or whether a fix exists.
- Moxa Inc. of Taiwan makes the affected industrial cellular router.
- Only an authenticated administrator is described as able to trigger it.
- Commands execute as the identity of the product's model process.
- The post went to Full Disclosure on October 28.
Impact: authenticated command execution as the model process
| Product | Affected |
|---|---|
| Moxa Inc. MAR-2000 | FWR_MAR2000_V1.0_Build_15010909 |
- Vendors
- Moxa Inc.
- Products
- MAR-2000
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1. 0_Build_15010909, from Moxa Inc. (Taiwan).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.