PT-2019-3535 · Moxa · Moxa Edr-810

Guillaume Lopes · Publicado 2019-08-10 · Atualizado 2021-10-28 · CVE-2019-10963

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moxa EDR 810 versions 5.1 and prior

Description The issue allows an unauthenticated attacker to retrieve some log files from the device, potentially leading to sensitive information disclosure. This is possible because log files must have previously been exported by a legitimate user. The vulnerability is related to inadequate access control, which can be exploited by a remote attacker using a specially crafted request.

Recommendations For Moxa EDR 810 versions 5.1 and prior, consider restricting access to the log files to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the export of log files by legitimate users to only necessary instances. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-321

Identificadores relacionados

BDU:2019-03712

CVE-2019-10963

Produtos afetados

Moxa Edr-810

Referências · 8

• 🔥 http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/47536 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10963 · Aviso do Fabricante
• https://t.me/cvenotify/22561 · Publicação no Telegram
• https://us-cert.gov/ics/advisories/icsa-19-274-03 · Nota
• https://bdu.fstec.ru/vul/2019-03712 · Nota de Segurança
• https://moxa.com/en/support/support/security-advisory/edr-810-series-secure-router-vulnerabilities-(1) · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10963 · Nota de Segurança