CVE-2024-4739 MXsecurity License Generation Function Disclosure

What is CVE-2024-4739?

CVE-2024-4739 is a medium-severity missing authorization vulnerability in Moxa MXsecurity Series, published on 18 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource.

Weakness: CWE-749

Which versions are affected by CVE-2024-4739?

It affects 1 product.

Products include Moxa Mxsecurity.

How do I fix CVE-2024-4739?

No fix has been published for CVE-2024-4739 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-4739 being exploited?

There is no known exploitation of CVE-2024-4739 in the wild and no public exploit code.

Other vulnerabilities in Moxa MXsecurity Series

• CVE-2023-39979 MXsecurity Authentication Bypass Critical 9.8
• CVE-2023-33236 MXsecurity Hardcoded Credential Vulnerability Critical 9.8
• CVE-2023-39981 MXsecurity Device Information Disclosure High 7.5
• CVE-2023-39982 MXsecurity Hardcoded Credential High 7.5
• CVE-2023-33235 MXsecurity Command Injection Vulnerability High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jj92-x469-335w.