Important Safety Flaws Reported in Moxa MXview Community Administration Software program

Technical particulars have been disclosed concerning quite a few safety vulnerabilities affecting Moxa’s MXview web-based community administration system, a few of which could possibly be chained by an unauthenticated adversary to attain distant code execution on unpatched servers.

The 5 safety weaknesses “may permit a distant, unauthenticated attacker to execute code on the internet hosting machine with the very best privileges accessible: NT AUTHORITYSYSTEM,” Claroty safety researcher Noam Moshe mentioned in a report printed this week.

Moxa MXview is designed for configuring, monitoring, and diagnosing networking units in industrial networks. The failings, which have an effect on variations 3.x to three.2.2 of the community administration software program, had been rectified in model 3.2.4 or increased following a coordinated disclosure course of in October 2021.

“Profitable exploitation of those vulnerabilities might permit an attacker to create or overwrite important recordsdata to execute code, acquire entry to this system, acquire credentials, disable the software program, learn and modify in any other case inaccessible knowledge, permit distant connections to inner communication channels, or work together and use MQTT remotely,” the U.S. Cybersecurity and Infrastructure Safety Company (CISA) mentioned in an advisory.

MQTT refers to a messaging protocol that facilitates distant asynchronous communication, enabling the switch of messages to and from completely different parts in an MXview setting.

The listing of flaws is as follows —

• CVE-2021-38452 (CVSS rating: 7.5) – A path traversal vulnerability within the software, permitting the entry or overwrite of important recordsdata used to execute code
• CVE-2021-38454 (CVSS rating: 10.0) – A misconfigured service that permits distant connections to MQTT, making it attainable to remotely work together and use the communication channel
• CVE-2021-38456 (CVSS rating: 9.8) – Use of hard-coded passwords
• CVE-2021-38458 (CVSS rating: 9.8) – A problem with improper neutralization of particular parts that might result in distant execution of unauthorized instructions
• CVE-2021-38460 (CVSS rating: 7.5) – A case of password leakage which will permit an attacker to acquire credentials

Three of the aforementioned flaws — CVE-2021-38452, CVE-2021-38454, and CVE-2021-38458, could possibly be strung collectively to attain pre-authenticated distant code execution on weak MXView cases with SYSTEM privileges.

In a hypothetical assault situation devised by Claroty, CVE-2021-38452 could possibly be abused to pay money for the plain-text MQTT password by studying the configuration file gateway-upper.ini, adopted by leveraging CVE-2021-38454 to inject rogue MQTT messages, triggering code execution by command injection on the server.

“An attacker injects malicious messages to the MQTT dealer immediately, bypassing all enter validation carried out by the server, and achieves arbitrary distant code execution by the OS command injection vulnerability,” Moshe defined.