Zero Radar
← feed
HighVulnerabilityupdated 29 Oct 2026, 06:54 UTC

Moxa MAR-2000 router: admin can run commands via saved settings fields

A logged-in administrator of this industrial cellular router can hide system commands inside ordinary settings fields, and the router then runs them. Anyone who gets admin access can take over the device.

1 source, unconfirmed
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Admin accountAttacker needs valid administrator login
  2. 2Saved settingsMalicious text placed in VPN or monitoring fields
  3. 3Router runs inputSettings are passed to a system shell
  4. 4Command executesRuns as the router's model process
  5. ResultAttacker controls the router

What happened

Three command injection flaws in Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 allow an authenticated administrator to inject shell commands through IPsec tunnel address fields, scenario ping condition fields, and the Executer program launch path, executing them as the product's model process.

Why it is dangerous: Successful exploitation gives command execution on the router, which typically sits at industrial sites and links networks to the internet, so a compromised device can expose connected equipment and networks.

Are you affected?

You are affected if you run Moxa MAR-2000 series routers on firmware FWR_MAR2000_V1.0_Build_15010909 and have administrator accounts that could be misused.

Moxa MAR-2000 series, firmware FWR_MAR2000_V1.0_Build_15010909

What to do

  1. Check whether your MAR-2000 runs firmware build FWR_MAR2000_V1.0_Build_15010909.
  2. Contact Moxa or check its security advisories for a patched firmware version and install it when available.
  3. Restrict administrator accounts to trusted staff and change default or shared passwords.
  4. Limit access to the router's management interface to trusted internal networks only.

Timeline

  1. 29 Oct 2026, 04:12 UTC
    Publicly disclosed
  2. 29 Oct 2026, 04:12 UTC
    Reported by Full Disclosure · Full Disclosure
  3. 29 Oct 2026, 04:12 UTC
    Reported by Full Disclosure · Full Disclosure
  4. 29 Oct 2026, 04:12 UTC
    Reported by Full Disclosure · Full Disclosure
  5. 29 Oct 2026, 04:15 UTC
    Picked up by Zero Radar

Sources 3 reports, oldest first

Security researchers research teams and mailing lists

Technical details

ID
ZR-99c07ad3 · ZR-e8aae3f3
Disclosed
29 Oct 2026, 04:12 UTC
On Zero Radar
29 Oct 2026, 04:15 UTC (3 min after disclosure)
Last change
29 Oct 2026, 06:54 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Moxa MAR-2000 router: admin can run commands via saved settings fields · Zero Radar