Moxa Service Missing Authentication for Critical Function

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Moxa). Independent of NVD's CPE analysis and usually ahead of it.

• Moxa EDF-G1002-BP Series

  • 1.0 and later · up to and including 3.12.1affected

• Moxa EDR-8010 Series

  • 1.0 and later · up to and including 3.12.1affected

• Moxa EDR-G9004 Series

  • 1.0 and later · up to and including 3.12.1affected

• Moxa EDR-G9010 Series

  • 1.0 and later · up to and including 3.12.1affected

• Moxa EDS-405A Series

  • 3.14.4not affected
  • 1.0 and later · up to and including 3.14affected

• Moxa EDS-408A Series

  • 3.14.6not affected
  • 1.0 and later · up to and including 3.12affected

• Moxa EDS-505A Series

  • 1.0 and later · up to and including 3.11affected

• Moxa EDS-508A Series

  • 1.0 and later · up to and including 3.11affected

• Moxa EDS-510A Series

  • 1.0 and later · up to and including 3.12affected

• Moxa EDS-510E Series

  • 1.0 and later · up to and including 5.5affected

• Moxa EDS-516A Series

  • 1.0 and later · up to and including 3.11affected

• Moxa EDS-518A Series

  • 1.0 and later · up to and including 3.11affected

Other highest-scoring records for the same primary product.

• CVE-2024-9140Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140.
  38Monitor
• CVE-2026-3868An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.
  34Monitor
• CVE-2024-9139OS Command Injection in Restricted Command
  34Monitor

Published before and after this one in the same product

• Later →CVE-2026-3867Apr 27, 2026 · An improper ownership management vulnerability has been identified in Moxa’s Secure Router.
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.