CVE-2024-9139OS Command Injection in Restricted Command
- 8.6HighCVSS base score
- 1.4%Exploitation in 30 daysEPSS · top 27% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.
Timeline
ID reserved
By Moxa
- 20 days later
· 20 days later
Published
- 23 days later
· 23 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| MoxaCNA (assigner) | 4.0 | High8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| MoxaCNA (assigner) | 3.1 | High7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 4.0 | High8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 1.4% · top 27% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.
Affected products
- affected 1.0 – ≤ 3.12.1
- affected 1.0 – ≤ 3.12.1
- affected 1.0 – ≤ 3.12.1
- affected 1.0 – ≤ 3.12.1
- affected 1.0 – ≤ 1.0.5
Moxa · OnCell G4302-LTE4 Series
- affected 1.0 – ≤ 3.9
- affected 1.0 – ≤ 3.6
- affected 1.0 – ≤ 5.12.33
What to do
Solution: Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for the affected products are shown below. * EDR-8010 Series: Upgrade to the firmware version 3.13 or later version. * EDR-G9004 Series: Upgrade to the firmware version 3.13 or later version. * EDR-G9010 Series: Upgrade to the firmware version 3.13 or later version. * EDF-G1002-BP Series: Upgrade to the firmware version 3.13 or later version. * NAT-102 Series: Please contact Moxa Technical Support for the security patch. * OnCell G4302-LTE4 Series: Upgrade to the firmware version 3.13 or later version. * TN-4900 Series: Upgrade to the firmware version 3.13 or later version. * EDR-810 Series: Upgrade to the firmware version 5.12.37 or later version.
Workaround: * Minimize network exposure to ensure the device is not accessible from the Internet. * Limit web access to trusted IP addresses and networks by using firewall rules or TCP wrappers. * Implement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks.
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-49752 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-9139)Record last updated .