CVE-2017-14433

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317

Description: A command injection issue exists in the web server functionality, allowing a specially crafted HTTP POST to cause a privilege escalation resulting in a root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the "/goform/net Web get value" endpoint to trigger this issue.

Recommendations: For Moxa EDR-810 version 4.1 build 17030317, consider restricting access to the "/goform/net Web get value" endpoint until a patch is available, and avoid using the remoteNetwork0= parameter in this endpoint to minimize the risk of exploitation.