Multiple Moxa product series are affected by the Linux kernel memory double free vulnerability. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component could be exploited to achieve a system crash and local privilege escalation.

The identified vulnerability types and potential impacts are shown below:

Vulnerability Scoring Details 

Affected Products:

The affected products and firmware versions are shown below.

Solutions:

Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below.

Mitigation:

• Minimize network exposure to ensure the device is not accessible from the Internet.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs).
• Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Supplementary Information:

The Moxa secure router series features protection through defense-in-depth software design. Currently, this vulnerability remains inaccessible to authorized users. Even if a third-party package defect occurs within Moxa Secure Router systems, there is no clear evidence of immediate impacts on OT system operations. The product team is working on the solution to eliminate the third-party package defect. Moxa advises users to implement the recommended mitigations to minimize the risk of exploitation. The mitigations provided are designed to reduce the vulnerability's impact and protect the integrity of the system.

Revision History: