Moxa Device Server Web Console Authorization Bypass Vulnerability

An attacker could bypass authentication to access the Device Server web console, potentially viewing or modifying device configuration, network settings, and serial port parameters without credentials. This could allow reconnaissance of your serial-to-Ethernet devices or changes to operational configurations.

Water utilities and power distributors using Moxa Device Servers (model 5232-N) to manage serial communications for RTUs, telemetry units, or legacy industrial equipment should be concerned. These servers are commonly used to convert serial Modbus or Profibus signals to Ethernet in SCADA and monitoring systems.

An attacker connects to the web console port (typically 80 or 443) of the Device Server from the network. The authorization check is insufficient, allowing the attacker to access restricted management functions without providing valid login credentials. From there, the attacker can read configuration or potentially trigger reconfiguration of serial or network settings.