Dove Chiu

Name of the Vulnerable Software and Affected Versions: Moxa MGate 5105-MB-EIP version 4.1 Description: The issue is related to the DestIP parameter in the Moxa MGate 5105-MB-EIP firmware, which lacks proper validation of user-supplied strings before executing system calls. This allows remote attackers to execute arbitrary code, potentially leading to privilege escalation. The exploitation requires authentication. The vulnerability is exploited through the `DestIP` parameter within the `MainPing.asp` endpoint. Recommendations: For version 4.1, consider restricting access to the `MainPing.asp` endpoint and the `DestIP` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows a remote attacker to execute arbitrary code with root privilege on the device by sending a crafted UDP request to the "Discover" service, which can lead to a stack overflow. This service provides functions such as changing passwords and retrieving basic information.

The issue allows an attacker to execute commands by forging malicious HTTP requests to the web service framework, but authentication is required before the attack can be executed.