PT-2015-7255 · Moxa · Moxa Softcms

Carsten Eiram + 1 · Publicado 2015-09-08 · Atualizado 2019-10-09 · CVE-2015-6458

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moxa SoftCMS versions 1.3 and prior

Description The issue is related to a buffer overflow condition that may cause the system to crash or allow remote code execution. The ip argument in the AudioRecord method of RTSPVIDEO.rtspvideoCtrl.1 is vulnerable to remote code execution.

Recommendations For Moxa SoftCMS versions 1.3 and prior, update to version 1.4 or later, which was released by Moxa on June 1, 2015, to address the issue. As a temporary workaround, consider restricting access to the RTSPVIDEO.rtspvideoCtrl.1 module and the AudioRecord method to minimize the risk of exploitation. Avoid using the ip argument in the affected method until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-120

Identificadores relacionados

CVE-2015-6458

ZDI-15-433

Produtos afetados

Moxa Softcms

Referências · 3

• https://zerodayinitiative.com/advisories/ZDI-15-433 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-239-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6458 · Nota de Segurança