PT-2017-3802 · Moxa · Moxa Ioxpress+1

Publicado 2017-05-09 · Atualizado 2020-03-26 · CVE-2019-18242

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Moxa ioLogik 2500 series firmware versions 3.0 or lower Moxa IOxpress configuration utility versions 2.3.0 or lower

Description The issue is related to an uncontrolled resource consumption in the firmware of Moxa ioLogik 2542-HSPA modules and the Moxa IOxpress Configuration Utility. This can be exploited by a remote attacker using specially crafted packets, potentially leading to a denial of service. Frequent and multiple requests for short-term use may cause the web server to fail.

Recommendations For Moxa ioLogik 2500 series firmware versions 3.0 or lower, consider restricting access to the web server to minimize the risk of exploitation until a patch is available. For Moxa IOxpress configuration utility versions 2.3.0 or lower, avoid using the utility for frequent and multiple requests for short-term use until the issue is resolved. As a temporary workaround, consider disabling the web server functionality in the affected firmware and utility until a patch is available.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-941

Identificadores relacionados

BDU:2019-03265

CVE-2019-18242

Produtos afetados

Moxa Ioxpress

Moxa Iologik 2500

Referências · 6

• https://us-cert.gov/ics/advisories/icsa-20-056-02 · Nota
• https://bdu.fstec.ru/vul/2019-03265 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18242 · Nota de Segurança
• https://moxa.com/en/support/support/security-advisory/iologik-2542-hspa-series-ioxpress-vulnerabilities · Nota
• https://t.me/cvenotify/2073 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-18242 · Aviso do Fabricante