CVE-2024-9138
Published: 03 January 2025
Summary
CVE-2024-9138 is a high-severity Reliance on Security Through Obscurity (CWE-656) vulnerability in Moxa (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 48.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-9138 is a high-severity vulnerability (CVSS 7.2, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) affecting Moxa's cellular routers, secure routers, and network security appliances. The issue stems from hard-coded credentials (CWE-656), which allow an authenticated user to escalate privileges and obtain root-level access to the system.
An attacker with high-level privileges (PR:H) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required. Successful exploitation grants root access, enabling high-impact confidentiality, integrity, and availability compromises, such as full system control.
Moxa's security advisory (MPSA-241155) details the privilege escalation and related OS command injection vulnerabilities in the affected products, providing guidance on mitigation measures. Security practitioners should consult the advisory at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo for patching instructions and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50434
Vulnerability details
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded credentials enable authenticated network-based privilege escalation to root (T1068) on public-facing appliances (T1190); related OS command injection directly maps to Unix shell execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of flaws such as hard-coded credentials through patching as specified in the vendor security advisory.
Requires proper management and protection of authenticators, directly preventing the embedding and exposure of hard-coded credentials that enable privilege escalation.
Enforces least privilege restrictions, limiting the scope and impact of privilege escalation even if hard-coded credentials are exploited by high-privilege users.