CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability
Attackers can exploit mandatory IP forwarding to bypass access controls and hide request sources on Moxa industrial switches.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0387?
CVE-2024-0387 is a medium-severity server-side request forgery vulnerability in Moxa EDS-4008 Series, published on 26 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests.
Weakness: CWE-1188
Which versions are affected by CVE-2024-0387?
It affects 7 products.
Products include Moxa Eds-4008 Firmware, Moxa Eds-4009 Firmware, Moxa Eds-4012 Firmware, Moxa Eds-4014 Firmware, Moxa Eds-G4008 Firmware, Moxa Eds-G4012 Firmware and 1 more.
How do I fix CVE-2024-0387?
No fix has been published for CVE-2024-0387 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-0387 being exploited?
There is no known exploitation of CVE-2024-0387 in the wild and no public exploit code.
Sources
Also known as GHSA-8q86-4x73-99v8.