bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Partly critical router holes endanger industrial networks

Summary

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

Ideas

  • Hard-coded credentials are a design flaw, not a configuration matter.
  • Industrial networks use devices whose compromise can have physical consequences.
  • A patch was not available for all models.
  • As a workaround, Moxa advised not making devices reachable from the internet and restricting SSH.

Insights

  • Because industrial IT is patched slowly, network segmentation is mandatory there.
  • Manufacturers with built-in access endanger entire industries.

Facts

  • The firmware was fixed in version 3.14 for the EDR-8010 and EDR-G9010, among others.
  • The holes were discovered by security researcher Lars Haulin.

References

Critique

  • The report does not say whether the holes had already been exploited.

Recommendations

  • Strictly separate OT networks from the internet and from office IT.
  • Use an IPS or anomaly detection in industrial networks, as Moxa recommends.

Read the original article

Search the Web Archive

g · 2011

Piwik 1.1 closes critical security holes

In January 2011 the free web analytics software Piwik appeared in version 1.1 with security holes closed. As a precaution, the developers had commissioned Stefan Esser’s company SektionEins with a five-day review of the source code. Its hardening advice was incorporated into the new version.

g · 2008

Critical security holes in PostgreSQL closed

In January 2008 the PostgreSQL developers closed five critical holes in all maintained versions from 7.3 to 8.2. Via expression indexes and DBLink functions, attackers could gain administrator rights, and via regular expressions they could bring the server down with a denial of service. The holes were found in the project’s own analyses, and no exploits were known.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.