This vulnerability (CWE-282) in Moxa EDR-8010 Series Secure Router arises from improper ownership management, enabling a low-privileged authenticated user to access a configuration file that contains the hashed administrative password. The exposure occurs only when the configuration file is exported. The CVSS 4.0 base score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, and required privileges. There is no impact on integrity or availability, and no known exploits in the wild. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker with low-privileged authenticated access can obtain sensitive information in the form of the hashed administrative password from an exported configuration file. This could potentially aid further attacks to escalate privileges. However, the vulnerability does not compromise system integrity or availability, nor does it affect downstream systems. Exploitation requires the configuration file to be exported, which is a specific precondition limiting the attack surface.

No official patch or remediation has been announced by Moxa. Since exploitation requires the configuration file to be exported, restricting or monitoring configuration export functionality and limiting low-privileged user access can reduce risk. Administrators should follow vendor advisories for updates and consider controlling access to configuration exports until an official fix is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.