Moxa MXsecurity Series Unauthenticated Device Registration Vulnerability

A vulnerability allowing unauthenticated device registration has been identified in the Moxa MXsecurity Series, in software versions through 2.3.0. This vulnerability arises from improperly controlled modifications of dynamically-determined object attributes. An unauthenticated remote attacker can exploit this issue by sending a specially crafted JSON payload to the device's registration endpoint, /api/v1/devices/register. This exploitation allows the registration of unauthorized devices without authentication. While the vulnerability enables limited data modification, it does not affect the confidentiality or availability of the impacted device or any subsequent systems.

Impact

Exploitation of this vulnerability allows for the unauthorized registration of devices, potentially leading to unauthorized access or control over those devices.

Remediation

Users are advised to update to version 2.3.1 or later. The update can be downloaded from the Moxa Software Licensing System.