CVE-2020-28144
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Moxa secure routers by sending specially crafted requests. It affects EDR-G903, EDR-G902, and EDR-810 series devices with vulnerable firmware versions. The high CVSS score indicates critical severity requiring immediate attention.
💻 Affected Systems
- EDR-G903 Series
- EDR-G902 Series
- EDR-810 Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to pivot to internal networks, intercept/modify traffic, disable security functions, or use the device as a persistent foothold.
Likely Case
Remote code execution leading to network disruption, data interception, or installation of malware/backdoors on the router.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
The vulnerability requires crafted requests but no authentication, making exploitation straightforward for attackers who discover the technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EDR-G903/G902: Firmware Version 5.6 or higher, EDR-810: Firmware Version 5.7 or higher
Vendor Advisory: https://www.moxa.com/en/support/support/security-advisory/edr-g903-g902-810-secure-router-vulnerability
Restart Required: Yes
Instructions:
1. Download latest firmware from Moxa support portal. 2. Backup current configuration. 3. Upload and install new firmware via web interface or CLI. 4. Restart device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation and Access Control
allRestrict network access to affected devices using firewall rules and network segmentation.
Disable Unnecessary Services
allDisable any unnecessary management interfaces or services on the routers.
🧯 If You Can't Patch
- Isolate affected devices in separate VLANs with strict firewall rules
- Implement network monitoring and intrusion detection for suspicious traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > System Information) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Confirm firmware version is EDR-G903/G902: 5.6+ or EDR-810: 5.7+📡 Detection & Monitoring
Log Indicators:
- Unusual connection attempts to router management interfaces
- Multiple failed login attempts followed by successful access
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns inconsistent with normal router operations
- Port scanning originating from router
SIEM Query:
source_ip IN (router_ips) AND (event_type="configuration_change" OR event_type="unusual_access")