PT-2015-3452 · Moxa · Moxa Eds-408A+1

Publicado 2015-09-03 · Atualizado 2015-09-14 · CVE-2015-6466

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moxa EDS-405A and Moxa EDS-408A versions prior to 3.6

Description The issue is related to insufficient protection of the web page structure in the Diagnosis Ping feature of the administrative web interface. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability also allows for cross-site scripting (XSS) attacks, where an attacker can inject arbitrary web script or HTML.

Recommendations For versions prior to 3.6, update the firmware to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Diagnosis Ping feature in the administrative web interface until a patch is available. Avoid using unspecified fields in the Diagnosis Ping feature that may be vulnerable to XSS attacks until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2024-05172

CVE-2015-6466

Produtos afetados

Moxa Eds-405A

Moxa Eds-408A

Referências · 5

• https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03 · Nota
• http://moxa.com/support/download.aspx?type=support&id=328 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-6466 · Nota de Segurança
• https://moxa.com/en/support/product-support/security-advisory/mpsa-154603-eds-405a-408a-series-multiple-web-vulnerabilities · Nota
• https://bdu.fstec.ru/vul/2024-05172 · Nota de Segurança