Moxa Moxa’s Response Regarding XZ Containing Malware/Backdoor (CVE-2024-3094)

Any Moxa product or system linked against the compromised xz/liblzma library (versions 5.6.0 and later) could be backdoored, allowing an attacker to intercept, modify, or exfiltrate data passing through that library—potentially affecting remote access, configuration management, or monitoring communications.

Water utilities, electric utilities, and other facilities using Moxa networking or industrial communication products should assess whether their systems are linked against xz 5.6.0 or later. This affects remote access gateways, managed switches, data acquisition devices, and any Moxa equipment compiled with the affected xz library versions. The risk is particularly high if Moxa products were built or updated between late 2023 and early 2024 when malicious xz versions were in circulation.

An attacker would need to compromise the software supply chain or trick a user into building/installing Moxa software linked against xz versions 5.6.0 or later. Once deployed, the backdoor in liblzma would silently intercept function calls, allowing data manipulation or command execution on affected devices without triggering normal authentication checks.