PT-2015-7255 · Moxa · Moxa Softcms

Carsten Eiram + 1 · Published 2015-09-08 · Updated 2019-10-09 · CVE-2015-6458

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moxa SoftCMS versions 1.3 and prior

Description The issue is related to a buffer overflow condition that may cause the system to crash or allow remote code execution. The ip argument in the AudioRecord method of RTSPVIDEO.rtspvideoCtrl.1 is vulnerable to remote code execution.

Recommendations For Moxa SoftCMS versions 1.3 and prior, update to version 1.4 or later, which was released by Moxa on June 1, 2015, to address the issue. As a temporary workaround, consider restricting access to the RTSPVIDEO.rtspvideoCtrl.1 module and the AudioRecord method to minimize the risk of exploitation. Avoid using the ip argument in the affected method until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2015-6458

ZDI-15-433

Affected Products

Moxa Softcms

References · 3

• https://zerodayinitiative.com/advisories/ZDI-15-433 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6458 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-239-01 · Note