Moxa Moxa’s Response Regarding the GNU Bourne-Again Shell (Bash) Vulnerability (Shellshock)

An attacker could execute arbitrary shell commands on affected Moxa devices by injecting malicious code into environment variables, potentially compromising device control functions and allowing unauthorized access to industrial processes.

Water utilities and municipal electric utilities using Moxa industrial communication devices (gateways, wireless modules, managed switches, protocol converters) are affected. Any Moxa product running Bash is at risk, particularly devices exposed to untrusted networks or with web interfaces, remote access capabilities, or API endpoints that process user input.

An attacker with network access to an affected Moxa device exploits Bash environment variable parsing to inject and execute arbitrary commands. If the device uses Bash to process external input or CGI parameters, the attacker can embed shell commands that execute with the privileges of the running process.