OTPulse
FeedAboutContact

Moxa Multiple ARM-Based Computers

Monitor7.8ICS-CERT ICSA-22-326-05Nov 22, 2022
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Moxa ARM-based industrial computers (UC-8100A-ME-T, UC-8410A, UC-8580, UC-8540, DA-662C-16-LX, UC-2100/2100-W, UC-3100, UC-5100, UC-8100, UC-8100-ME-T, UC-8200, AIG-300) are vulnerable to local privilege escalation via insufficient privilege controls. An attacker with a local user account can escalate to root, gaining complete control over the device. Vulnerability is not remotely exploitable and no public exploits are known.

What this means
What could happen
An attacker with local access to a Moxa industrial computer could gain root-level control of the system, allowing them to modify process configurations, disable monitoring, or disrupt operations.
Who's at risk
Water authorities and utilities running Moxa ARM-based industrial computers (UC-series, DA-662C, AIG-300) for SCADA data acquisition, process monitoring, or remote telemetry should assess exposure. These devices are common in pump stations, treatment plants, and distribution network control points.
How it could be exploited
An attacker with local user access to the device can escalate privileges to root by exploiting insufficient privilege controls. This requires physical or local network access to the industrial computer—an attacker cannot gain initial access remotely, but once logged in as a standard user, they can assume full system control.
Prerequisites
  • Local user account on the affected Moxa industrial computer
  • Physical access or local network access to the device
  • Default or weak local credentials
No patch availableAffects OT equipmentPrivilege escalation to rootLow CVSS vector (local access required)
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (13)
13 EOL
ProductAffected VersionsFix Status
ARM-Based Computers - UC-8100A-ME-T System Image:≥ 1.0 | ≤ 1.6No fix (EOL)
ARM-Based Computers - UC-8410A with Debian 9 System Image:≥ 4.0.2 | ≤ 4.1.2No fix (EOL)
ARM-Based Computers - UC-8580 with Debian 9 System Image:≥ 2.0 | ≤ 2.1No fix (EOL)
ARM-Based Computers - DA-662C-16-LX (GLB) System Image:≥ 1.0.2 | ≤ 1.1.2No fix (EOL)
ARM-Based Computers - UC-2100 System Image:≥ 1.0 | ≤ 1.12No fix (EOL)
ARM-Based Computers - UC-3100 System Image:≥ 1.0 | ≤ 1.6No fix (EOL)
ARM-Based Computers - UC-5100 System Image:≥ 1.0 | ≤ 1.4No fix (EOL)
ARM-Based Computers - UC-8100 System Image:≥ 3.0 | ≤ 3.5No fix (EOL)
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGEnforce least-privilege principle—ensure local user accounts have minimal necessary permissions and service accounts do not run as root
HARDENINGRestrict physical and local network access to Moxa computers; allow only authorized personnel and devices
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Moxa security update to system image according to Moxa's published security advisory
Mitigations - no patch available
0/2
The following products have reached End of Life with no planned fix: ARM-Based Computers - UC-8100A-ME-T System Image:, ARM-Based Computers - UC-8410A with Debian 9 System Image:, ARM-Based Computers - UC-8580 with Debian 9 System Image:, ARM-Based Computers - DA-662C-16-LX (GLB) System Image:, ARM-Based Computers - UC-2100 System Image:, ARM-Based Computers - UC-3100 System Image:, ARM-Based Computers - UC-5100 System Image:, ARM-Based Computers - UC-8100 System Image:, ARM-Based Computers - UC-8100-ME-T System Image:, ARM-Based Computers - UC-8200 System Image: v1.0 to v1.5, ARM-Based Computers - AIG-300 System Image: v1.0 to v1.4, ARM-Based Computers - UC-8540 with Debian 9 System Image:, ARM-Based Computers - UC-2100-W System Image:. Apply the following compensating controls:
HARDENINGPlace industrial computers behind firewalls and isolate from business networks and the Internet
HARDENINGUse VPN or other secure methods for any required remote access, keeping VPN software updated
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/08eab8f1-cbd8-4e5c-b3b0-0fc01d39f131
Moxa Multiple ARM-Based Computers | CVSS 7.8 - OTPulse