OTPulse
FeedAboutContact

Moxa TAP-213/TAP-323 Series Wireless AP/Bridge/Client Vulnerabilities

Monitor7tap-213-tap-323-series-wireless-ap-bridge-client-vulnerabilitiesDec 30, 2021
Summary

Multiple vulnerabilities exist in Moxa TAP-213/TAP-323 Series Wireless AP/Bridge/Client devices across all versions: 1. Command Injection (CVE-2021-37752): Arbitrary command execution via web interface 2. Authentication Bypass (CVE-2021-37753, CVE-2021-37755): Remote authentication bypass and unencrypted credential storage 3. Buffer Overflow (CVE-2021-37757): Service crash via improper input restriction 4. Information Disclosure (CVE-2021-37751): Sensitive information exposure to unauthorized users 5. Weak Brute Force Protection (CVE-2021-37754): Insufficient authentication attempt limiting 6. Cross-Site Scripting (CVE-2021-37756): HTML/JavaScript injection via web interface 7. Firmware Verification (CVE-2021-37758): Improper firmware signature verification allows malicious firmware installation Moxa has indicated solutions are in development but no patched versions have been released.

What this means
What could happen
An attacker with network access to these wireless access points could execute arbitrary commands on the device, bypass authentication to access administrative functions, or install malicious firmware. This could allow an attacker to reconfigure network routing, intercept wireless traffic, or disrupt network connectivity for connected equipment.
Who's at risk
Water utilities, electric utilities, and other industrial facilities using Moxa TAP-213/TAP-323 wireless access points or bridges for network connectivity should be concerned. These devices are typically deployed at remote sites, substation networks, or process control network edges to provide wireless connectivity for field equipment, SCADA systems, or engineering access. Compromise could disrupt critical wireless network segments.
How it could be exploited
An attacker on the network or internet can connect to the web interface and exploit command injection or authentication bypass to gain administrative access without valid credentials. Alternatively, the attacker could brute force weak credentials due to lack of rate limiting, then execute commands or upload malicious firmware through the unverified firmware update mechanism.
Prerequisites
  • <parameter name="prerequisites"> <parameter name="item">Network access to the web interface (HTTP/HTTPS port, typically 80/443)
<parameter name="item">Remotely exploitable
Affected products (1)
ProductAffected VersionsFix Status
TAP-213/TAP-323All versionsNo fix yet
View full Moxa Security advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/4ea09659-754d-4110-ae39-57396ea4f4b3
Moxa TAP-213/TAP-323 Series Wireless AP/Bridge/Client Vulnerabilities | CVSS 7 - OTPulse