CVE-2024-4638

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4638
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:moxa:oncell_g3470a-lte-eu-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-eu-t:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:moxa:oncell_g3470a-lte-eu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-eu:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:moxa:oncell_g3470a-lte-us_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-us:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:moxa:oncell_g3470a-lte-us-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-us-t:-:*:*:*:*:*:*:*
History

24 Sep 2024, 17:13

Type Values Removed Values Added
CPE cpe:2.3:o:moxa:oncell_g3470a-lte-eu-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:oncell_g3470a-lte-us-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-eu:-:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-us:-:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-eu-t:-:*:*:*:*:*:*:*
cpe:2.3:h:moxa:oncell_g3470a-lte-us-t:-:*:*:*:*:*:*:*
cpe:2.3:o:moxa:oncell_g3470a-lte-eu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:oncell_g3470a-lte-us_firmware:*:*:*:*:*:*:*:*
First Time Moxa oncell G3470a-lte-eu Firmware
Moxa oncell G3470a-lte-eu-t
Moxa oncell G3470a-lte-eu-t Firmware
Moxa oncell G3470a-lte-us-t Firmware
Moxa oncell G3470a-lte-us Firmware
Moxa oncell G3470a-lte-us
Moxa oncell G3470a-lte-eu
Moxa
Moxa oncell G3470a-lte-us-t
CVSS v2 : unknown
v3 : 7.1 		v2 : unknown
v3 : 8.8
References () https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities - () https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities - Vendor Advisory

25 Jun 2024, 12:24

Type Values Removed Values Added
Summary
  • (es) Las versiones de firmware de la serie OnCell G3470A-LTE v1.7.7 y anteriores han sido identificadas como vulnerables debido a la falta de entradas neutralizadas en la función de carga de clave web. Un atacante podría modificar los comandos previstos enviados a las funciones de destino, lo que podría provocar que usuarios malintencionados ejecuten comandos no autorizados.

25 Jun 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-25 09:15

Updated : 2024-09-24 17:13

NVD link : CVE-2024-4638

Mitre link : CVE-2024-4638

CVE.ORG link : CVE-2024-4638

JSON object : View

Products Affected

moxa

  • oncell_g3470a-lte-eu
  • oncell_g3470a-lte-us_firmware
  • oncell_g3470a-lte-us-t
  • oncell_g3470a-lte-eu-t
  • oncell_g3470a-lte-eu_firmware
  • oncell_g3470a-lte-us-t_firmware
  • oncell_g3470a-lte-eu-t_firmware
  • oncell_g3470a-lte-us
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')