title: Command-injection Vulnerability in Certificate Management
description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
problem types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
defaultStatus: unaffected
product: TN-5900 Series
vendor: Moxa
versions:
lessThanOrEqual: 3.3, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: TN-4900 Series
vendor: Moxa
versions:
lessThanOrEqual: 1.2.4, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-810 Series
vendor: Moxa
versions:
lessThanOrEqual: 5.12.27, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G902 Series
vendor: Moxa
versions:
lessThanOrEqual: 5.7.17, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G903 Series
vendor: Moxa
versions:
lessThanOrEqual: 5.7.15, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: EDR-G9010 Series
vendor: Moxa
versions:
lessThanOrEqual: 2.1, status: affected, version: 1.0, versionType: custom
}
{
defaultStatus: unaffected
product: NAT-102 Series
vendor: Moxa
versions:
lessThanOrEqual: 1.0.3, status: affected, version: 1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Moxa has developed appropriate solution to address the vulnerability. The solution for affected products is shown below:
*  TN-4900 Series: Please upgrade to firmware  v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources
*  TN-5900 Series: Please upgrade to firmware  v3.4 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/en-50155-routers/tn-5900-series#resources
*  EDR-810 Series: Please upgrade to firmware  v5.12.29 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-810-series#resources
*  EDR-G902 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g902-series
*  EDR-G903 Series: Please upgrade to firmware  v5.7.21 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g903-series#resources
*  EDR-G9010 Series: Please upgrade to firmware  v3.0 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/edr-g9010-series#resources
*  NAT-102 Series: Please upgrade to firmware  v1.0.5 or higher. https://www.moxa.com/en/products/industrial-network-infrastructure/secure-routers/secure-routers/nat-102-series#resources