CVE-2020-28144 Code injection in n/a
Remote attackers can execute arbitrary code on Moxa industrial routers via crafted requests due to improper operation restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28144?
CVE-2020-28144 is a critical code injection vulnerability in n/a, published on 3 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution.
Weakness: CWE-119
Which versions are affected by CVE-2020-28144?
It affects 8 products.
Products include Moxa Edr-810-2gsfp-T Firmware, Moxa Edr-810-2gsfp Firmware, Moxa Edr-810-Vpn-2gsfp-T Firmware, Moxa Edr-810-Vpn-2gsfp Firmware, Moxa Edr-G902-T Firmware, Moxa Edr-G902 Firmware and 2 more.
How do I fix CVE-2020-28144?
No fix has been published for CVE-2020-28144 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-28144 being exploited?
There is no known exploitation of CVE-2020-28144 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hvcx-w6jp-qm72.