Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Three unfixed command-injection flaws hit Moxa MAR-2000 firmware

1 source · 3 articlesFirst reported Updated ()1
What's new

October 29: A third authenticated command-injection flaw was disclosed in the auto-executing scenario ping thread, rated 7.2, with no fix named.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers disclosed three authenticated command-injection flaws in Moxa MAR-2000 firmware, with no CVE or fix named.

0day Rubbish Research Team disclosed three command-injection flaws in Moxa MAR-2000 industrial 4G/LTE router firmware FWR_MAR2000_V1.0_Build_15010909. An authenticated administrator can turn stored configuration fields into commands that run as the product's model process. One flaw is in the Executer path that launches an operator program as a shell command. Another interpolates a stored VPN address into IPsec route-management shell commands. A third stores a monitoring-condition field that a scheduled scenario ping thread later executes. None of the posts names a CVE or a fixed release.

Key facts
  • Affected image is FWR_MAR2000_V1.0_Build_15010909.
  • All three flaws require an authenticated administrator.
  • Commands execute as the product's model process.
  • Scenario ping injection runs on a product schedule.
  • No CVE identifier or fixed release is named.
  • Moxa Inc. of Taiwan makes the industrial cellular router.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Executer and IPsec injection posts sent to Full Disclosure. · Full Disclosure
  2. Oct 29, 2026Scenario ping command-injection disclosure published. · Full Disclosure

What each outlet adds

beyond the shared facts
  • Full DisclosureExecuter path builds an operator-program launch command as a shell command.
  • Full DisclosureIPsec model interpolates a stored VPN address into route-management commands.
  • Full DisclosureSaved monitoring field is reused by a scheduled ping thread for recurring execution.
Vendors
MoxaMoxa Inc.
Products
MAR-2000
Organizations
0day Rubbish Research Team
Countries
Taiwan

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Full DisclosureFirst report

    Moxa MAR-2000 Executer path allows authenticated command injection

    A stored configuration field is built into the shell command that launches an operator program as the model process.

  2. · 1d ago Full Disclosure

    Moxa MAR-2000 IPsec route commands allow authenticated injection

    Firmware FWR_MAR2000_V1.0_Build_15010909 interpolates a stored VPN address into shell commands run as the model process.

  3. · 1d ago Full Disclosure

    Moxa MAR-2000 firmware ping condition allows command injection

    A saved monitoring field is reused by a scheduled ping thread for recurring command execution.