title: Second Order Command-injection Vulnerability in the Certificate-delete Function
description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
product: TN-5900 Series
vendor: Moxa
versions:
lessThanOrEqual: 3.3, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: TN-4900 Series
vendor: Moxa
versions:
lessThanOrEqual: 1.2.4, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G902 Series
vendor: Moxa
versions:
lessThanOrEqual: 5.7.17, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G903 Series
vendor: Moxa
versions:
lessThanOrEqual: 5.7.15, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G9010 Series
vendor: Moxa
versions:
lessThanOrEqual: 2.1, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: NAT-102 Series
vendor: Moxa
versions:
lessThanOrEqual: 1.0.3, status: affected, version: 1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:
*    *  TN-4900 Series: Please upgrade to firmware  v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources
*  TN-5900 Series: Please upgrade to firmware  v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources
*  EDR-G902 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series
*  EDR-G903 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources
*  EDR-G9010 Series: Please upgrade to firmware  v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources
*  NAT-102 Series: Please upgrade to firmware  v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources