CVE-2024-7695: Multiple Switches DoS Vulnerability

CVE-2024-7695 Overview

CVE-2024-7695 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Moxa industrial Ethernet switches. The flaw stems from insufficient input validation, which allows data to be written to memory locations outside the bounds of the intended buffer. A remote, unauthenticated attacker can trigger the condition over the network to cause a denial-of-service (DoS) condition on the affected device. Moxa has issued three security advisories covering PT series, EDS/ICS/IKS/SDS series, and EN 50155 series switches. The vulnerability does not require user interaction or privileges, raising the operational risk to industrial control networks that depend on these switches for deterministic Ethernet communications.

Critical Impact
Remote unauthenticated attackers can crash or reboot affected Moxa switches, disrupting industrial network availability and downstream operational technology (OT) processes.

Affected Products

Moxa PT series switches (see Moxa Security Advisory MPSA-240162)
Moxa EDS, ICS, IKS, and SDS series switches (see Moxa Security Advisory MPSA-240163)
Moxa EN 50155 series switches (see Moxa Security Advisory MPSA-240164)

Discovery Timeline

2025-01-29 - CVE-2024-7695 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-7695

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds write [CWE-787]. Affected Moxa switch firmware fails to validate the size or structure of attacker-supplied input before writing it into a fixed-size buffer. When crafted network traffic reaches the vulnerable parser, the firmware writes beyond the allocated buffer boundary. This memory corruption disrupts internal data structures the switch relies on for packet processing and management. The most reliable outcome is a process crash or watchdog-triggered reboot, producing a denial-of-service condition. While only availability impact is reported, out-of-bounds writes can in some cases be leveraged for further compromise depending on adjacent memory layout.

Root Cause

The root cause is insufficient input validation in firmware code paths that handle incoming protocol data. The affected functions do not enforce length or bounds checks before copying or writing data into stack or heap buffers. As a result, oversized or malformed inputs overflow the destination buffer.

Attack Vector

Exploitation occurs over the network and requires no authentication or user interaction. An attacker with network reachability to a management or data plane interface of an affected switch can send crafted packets to trigger the out-of-bounds write. Devices exposed to untrusted networks, or accessible through flat OT network segments, face the highest exposure.

No public proof-of-concept code has been released. Technical details on the specific vulnerable component are not disclosed in the Moxa advisories; refer to the vendor advisories linked above for protocol and version specifics.

Detection Methods for CVE-2024-7695

Indicators of Compromise

Unexpected reboots, watchdog resets, or process crashes on Moxa PT, EDS, ICS, IKS, SDS, or EN 50155 series switches.
Sudden loss of management connectivity (SSH, HTTPS, SNMP) followed by device recovery without an authorized change.
Gaps in syslog or SNMP trap streams from affected switches coinciding with malformed inbound traffic.

Detection Strategies

Inspect switch syslog and SNMP traps for repeated crash, restart, or kernel fault messages.
Deploy network IDS/IPS signatures that flag malformed management-protocol traffic directed at switch IP addresses.
Baseline switch CPU, memory, and uptime metrics, and alert on anomalous reboots that do not correlate with maintenance windows.

Monitoring Recommendations

Forward switch logs into a centralized SIEM or data lake and correlate device reboots with upstream network events.
Monitor north-south and east-west traffic to OT network segments for unsolicited connections to switch management interfaces.
Track firmware versions across the Moxa fleet to ensure patched builds are deployed and remain installed.

How to Mitigate CVE-2024-7695

Immediate Actions Required

Inventory all Moxa PT, EDS, ICS, IKS, SDS, and EN 50155 series switches and identify firmware versions against the vendor advisories.
Apply the firmware updates referenced in Moxa advisories MPSA-240162, MPSA-240163, and MPSA-240164 as soon as maintenance windows allow.
Restrict network reachability to switch management interfaces using firewall rules, VLAN segmentation, and jump-host access.
Disable unused management protocols and services on affected switches to reduce the attack surface.

Patch Information

Moxa has published fixed firmware and mitigation guidance in three advisories: MPSA-240162 for PT switches, MPSA-240163 for EDS/ICS/IKS/SDS switches, and MPSA-240164 for EN 50155 switches. Consult each advisory for the exact fixed firmware versions and upgrade procedures for your model.

Workarounds

Place affected switches behind a defense-in-depth perimeter that blocks untrusted access to management interfaces.
Apply access control lists (ACLs) on the switch to permit management traffic only from a small set of authorized administrative hosts.
Segment OT networks from IT and external networks using firewalls and unidirectional gateways where applicable.
Maintain offline configuration backups so affected devices can be quickly restored after a DoS-induced reboot.

bash

# Example: restrict management access to a trusted admin subnet
# (apply equivalent commands per Moxa CLI/Web UI for your model)
access-list 10 permit 10.10.20.0 0.0.0.255
access-list 10 deny   any log
interface vlan 1
  ip access-group 10 in