Critical OpenSSH Flaw Exposes Moxa Switches Vulnerability Ethernet

Moxa has issued a critical security advisory concerning CVE-2023-38408, a severe OpenSSH vulnerability impacting multiple Ethernet switch models.

The flaw, with a CVSS 3.1 score of 9.8, allows unauthenticated remote attackers to execute arbitrary code on vulnerable devices without requiring user interaction.

CVE-2023-38408 stems from an unreliable search path in the PKCS#11 feature of OpenSSH’s ssh-agent before 9.3p2.

The vulnerability (CWE-428) is classified as an unquoted search path issue, enabling remote code execution when an SSH agent is forwarded to an attacker-controlled system.

This security flaw represents an incomplete fix for the earlier CVE-2016-10009 vulnerability.

Attackers can exploit this weakness to achieve complete system compromise, including breaches of confidentiality, integrity, and availability.

Affected Products

This vulnerability impacts multiple Moxa switch series.

Moxa recommends users immediately contact Moxa Technical Support to obtain the latest security patches.

Organizations using affected EDS-series devices should upgrade to firmware version 4.1.58, while RKS-series users should upgrade to version 5.0.4.

Until patches can be deployed, Moxa advises implementing restrictive network access controls, such as firewalls and ACLs, to limit communication to trusted networks only.

Organizations should segregate operational networks from enterprise networks using VLANs or physical separation, turn off unnecessary network services, and avoid exposing devices directly to the Internet.

Implementing multi-factor authentication, role-based access control, and continuous network traffic monitoring for anomalous activity adds an additional layer of security.

Regular vulnerability assessments and firmware update schedules are essential components of a comprehensive defense strategy.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.