PT-2013-1695 · Moxa · Moxa Edr-G903 Series

Publicado 2013-02-15 · Atualizado 2013-02-15 · CVE-2012-4694

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDR-G903 series routers versions prior to 2.11

Description The issue concerns the insufficient source of entropy used for generating SSH and SSL keys. This weakness can be exploited by man-in-the-middle attackers to spoof a device or modify a client-server data stream, especially if they have knowledge of a key from another product installation.

Recommendations For versions prior to 2.11, update the firmware to version 2.11 or later to address the issue with insufficient entropy for SSH and SSL keys.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-4694

Produtos afetados

Moxa Edr-G903 Series

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-4694 · Nota de Segurança
• http://moxa.com/support/download.aspx?type=support&id=492 · Nota
• http://ics-cert.us-cert.gov/pdf/ICSA-13-042-01.pdf · Nota