Industrial networking manufacturer Moxa reports ‘critical’ router bugs

Moxa disclosed two high-severity firmware vulnerabilities—CVE-2024-9138 (hardcoded credentials enabling privilege escalation to root) and CVE-2024-9140 (input-bypass leading to OS command injection exploitable remotely without authentication). Combined CVSS scores are 8.6 and 9.8; patches have been released for many but not all affected devices, and Moxa advises isolating vulnerable devices, restricting SSH, and monitoring for exploitation while some customers must contact support for updates.