PT-2017-3774 · Moxa · Moxa Eds+1

Publicado 2017-11-13 · Atualizado 2021-11-03 · CVE-2019-6526

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDS versions 3.8 and prior Moxa IKS-G6824A series versions 4.5 and prior

Description The issue is related to the lack of encryption for protected data in the firmware of Moxa EDS and IKS switches. This may allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves the plaintext transmission of sensitive data, which could include administrative passwords.

Recommendations For Moxa EDS versions 3.8 and prior, update to a version that includes encryption for sensitive data transmission. For Moxa IKS-G6824A series versions 4.5 and prior, update to a version that includes encryption for sensitive data transmission. As a temporary workaround, consider restricting access to the switches to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-319

CWE-311

Identificadores relacionados

BDU:2019-01124

CVE-2019-6526

Produtos afetados

Moxa Eds

Moxa Iks-G6824A

Referências · 5

• https://bdu.fstec.ru/vul/2019-01124 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6526 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 · Nota
• https://moxa.com/en/support/product-support/security-advisory/eds-405a-series-eds-408a-series-eds-510a-series-and-iks-g6824a-series-ethernet-switches-vulnerabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6526 · Nota de Segurança