CVE-2024-4740: Medium Hard-Coded Credentials in Moxa MXsecurity

CVE-2024-4740 is a medium severity flaw in Moxa MXsecurity software version 1.1.0 and prior, scored 5.3. The software uses hard-coded credentials, which could let an attacker tamper with sensitive data. Moxa's advisory says to upgrade to firmware 2.2.0 or higher and to keep the device off the internet.

What's affected

Moxa advisory MPSA-231878 lists the MXsecurity series, software version v1.1.0 and prior. The weakness is CWE-798, use of hard-coded credentials. The advisory impact statement says an attacker could tamper with sensitive data.

The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium, flagged as an unauthenticated remote exploit. NVD and Moxa agree on the number. One small oddity: the vector shows low confidentiality impact and no integrity impact, while the text speaks of tampering. The advisory is the vendor's own statement, so I report both rather than pick one.

This CVE and CVE-2024-4739 share an advisory and affected versions but are different flaws. The first is a missing access restriction, and this one is a credential baked into the product. The KEV flag is false.

How to check if you're exposed

1. Locate every MXsecurity install and read its software version.
2. Anything at v1.1.0 or earlier is in range.
3. Check whether the web interface or API of the server is reachable beyond the management network.
4. Search firewall configurations for rules that allow the management port from broad address ranges.

If you cannot upgrade immediately, a network layer control matters more than anything inside the product, because a shared credential works for whoever knows it.

What to do now

1. Upgrade to firmware 2.2.0 or higher through the Moxa Software Licensing Portal.
2. Minimize network exposure. The advisory says the device should not be accessible from the internet.
3. Use a VPN or similar secure method for remote access.
4. After the upgrade, change administrator passwords and any API tokens.
5. Check configuration and rule changes made on managed devices for anything you do not recognise.
6. Confirm in the advisory whether further steps apply to your deployment.

Why it matters

A hard-coded credential cannot be rotated by the customer, because it lives in the code or firmware. Every installation of the affected versions shares it, and anyone who extracts it from one copy has it for all. That is the heart of CWE-798.

The usual defence is to generate a unique secret at install time and let the owner change it. When a product does not, the fix has to come from the vendor in a new version. Until you apply it, the network is your only barrier, so keep the management plane as small as you can.

Quick check

Sources

• Moxa advisory MPSA-231878
• NVD record data for CVE-2024-4740

Last reviewed: 19 October 2026.