Moxa NPort IAW5000A-I/O serial device server: The built-in web server doesn't validate input properly, letting a remote

Impact

The built-in web server doesn't validate input properly, letting a remote unauthenticated attacker run arbitrary commands on the device server — full takeover of the box bridging serial equipment onto the network.

Who can reach it

Remote, unauthenticated — a crafted HTTP request to the web management interface is enough.

What to do

Firmware upgrade to the version Moxa published in its security advisory; requires a flash and reboot on every affected unit, which briefly drops the serial sessions it's carrying. No compensating config change exists since the flaw is in input handling, not a feature you can disable.

References