Critical Alert: Moxa Switches Exposed to OpenSSH Remote Code Execution (CVSS 9.8)

A critical vulnerability in Moxa’s industrial ethernet switches has been identified, with the flaw affecting the OpenSSH component used by the devices and a CVSS score of 9.8. The vulnerability, tracked as CVE-2023-38408, stems from an unreliable search path in the PKCS#11 feature of OpenSSH’s ssh-agent versions prior to 9.3p2, potentially allowing remote code execution if an agent is forwarded to a system controlled by an attacker.

Moxa has named two affected product series: the EDS Series (models including EDS-G4000, EDS-4008, EDS-4009, EDS-4012, EDS-4014, EDS-G4008, EDS-G4012, and EDS-G4014; vulnerable firmware version 4.1 and earlier) and the RKS Series (models RKS-G4000, RKS-G4028, and RKS-G4028-L3; vulnerable firmware version 5.0 and earlier). Patches have been developed, but direct public download is not available; organisations should contact Moxa Technical Support to obtain the appropriate patch files for the respective series.

In the meantime, defenders are advised to deploy a defence-in-depth approach, restricting access with firewalls or ACLs, minimising exposure by avoiding Internet-facing setups, strengthening authentication with MFA and RBAC, securing communications via VPN or SSH restricted to authorised personnel, and monitoring for anomalous activity. 13 January 2026