Moxa: Moxa Switches Vulnerability Allows Attackers to Bypass Authentication

Critical Authentication Bypass Flaw in Moxa Industrial Switches Exposes Networks to Remote Attacks

Moxa has released a critical security advisory (MPSA-241409) addressing a severe authentication bypass vulnerability in its industrial Ethernet switches, tracked as CVE-2024-12297 (CVSS 9.2). The flaw, disclosed on February 4, 2026, affects the TN-A and TN-G series and stems from improper coordination between client-side and backend authorization logic.

The vulnerability, dubbed "Frontend Authorization Logic Disclosure," allows attackers to exploit weak authentication mechanisms via brute-force attacks or MD5 hash collision techniques to forge credentials. Successful exploitation could grant unauthorized access to switch management interfaces, enabling lateral movement or configuration tampering within industrial networks. The root cause was identified as reliance on obscured authentication logic rather than secure server-side validation.

Affected Products & Remediation:

• TN-A Series (TN-4500A, TN-5500A): Firmware v4.1 and earlier – Patch to v3.13.255.
• TN-G Series (TN-G4500, TN-G6500): Firmware v5.5 and earlier – Patch to v5.5.255.

For organizations unable to immediately apply patches, Moxa recommends restricting network access to trusted hosts, enabling network segmentation, and auditing logs for suspicious activity. The vulnerability poses a high risk to industrial communication networks, emphasizing the need for prompt patching and post-update verification.

Source: https://cyberpress.org/moxa-switches-vulnerability/

Moxa cybersecurity rating report: https://www.rankiteo.com/company/moxa

"id": "MOX1770302285",
"linkid": "moxa",
"type": "Vulnerability",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Industrial Networking',
                        'name': 'Moxa',
                        'type': 'Company'}],
 'attack_vector': 'Remote',
 'date_publicly_disclosed': '2026-02-04',
 'description': 'Moxa has released a critical security advisory (MPSA-241409) '
                'addressing a severe authentication bypass vulnerability in '
                'its industrial Ethernet switches, tracked as CVE-2024-12297 '
                '(CVSS 9.2). The flaw affects the TN-A and TN-G series and '
                'stems from improper coordination between client-side and '
                'backend authorization logic. The vulnerability allows '
                'attackers to exploit weak authentication mechanisms via '
                'brute-force attacks or MD5 hash collision techniques to forge '
                'credentials, granting unauthorized access to switch '
                'management interfaces, enabling lateral movement or '
                'configuration tampering within industrial networks.',
 'impact': {'operational_impact': 'Unauthorized access to switch management '
                                  'interfaces, lateral movement, configuration '
                                  'tampering',
            'systems_affected': 'Industrial Ethernet switches (TN-A and TN-G '
                                'series)'},
 'lessons_learned': 'Reliance on obscured authentication logic rather than '
                    'secure server-side validation is insufficient for '
                    'security. Prompt patching and post-update verification '
                    'are critical.',
 'post_incident_analysis': {'corrective_actions': ['Patch vulnerable systems',
                                                   'Implement secure '
                                                   'server-side validation',
                                                   'Enhance authentication '
                                                   'mechanisms'],
                            'root_causes': 'Improper coordination between '
                                           'client-side and backend '
                                           'authorization logic, reliance on '
                                           'obscured authentication logic '
                                           'instead of secure server-side '
                                           'validation'},
 'recommendations': ['Apply patches immediately',
                     'Restrict network access to trusted hosts',
                     'Enable network segmentation',
                     'Audit logs for suspicious activity'],
 'references': [{'source': 'Moxa Security Advisory (MPSA-241409)'}],
 'response': {'containment_measures': ['Restricting network access to trusted '
                                       'hosts',
                                       'Enabling network segmentation',
                                       'Auditing logs for suspicious activity'],
              'enhanced_monitoring': 'Recommended',
              'network_segmentation': 'Recommended',
              'remediation_measures': ['Patch to v3.13.255 (TN-A Series)',
                                       'Patch to v5.5.255 (TN-G Series)']},
 'title': 'Critical Authentication Bypass Flaw in Moxa Industrial Switches '
          'Exposes Networks to Remote Attacks',
 'type': 'Authentication Bypass',
 'vulnerability_exploited': 'CVE-2024-12297 (Frontend Authorization Logic '
                            'Disclosure)'}