PT-2013-1695 · Moxa · Moxa Edr-G903 Series

Published 2013-02-15 · Updated 2013-02-15 · CVE-2012-4694

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDR-G903 series routers versions prior to 2.11

Description The issue concerns the insufficient source of entropy used for generating SSH and SSL keys. This weakness can be exploited by man-in-the-middle attackers to spoof a device or modify a client-server data stream, especially if they have knowledge of a key from another product installation.

Recommendations For versions prior to 2.11, update the firmware to version 2.11 or later to address the issue with insufficient entropy for SSH and SSL keys.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-4694

Affected Products

Moxa Edr-G903 Series

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-4694 · Security Note
• http://moxa.com/support/download.aspx?type=support&id=492 · Note
• http://ics-cert.us-cert.gov/pdf/ICSA-13-042-01.pdf · Note