PT-2017-3774 · Moxa · Moxa Eds+1

Published 2017-11-13 · Updated 2021-11-03 · CVE-2019-6526

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa EDS versions 3.8 and prior Moxa IKS-G6824A series versions 4.5 and prior

Description The issue is related to the lack of encryption for protected data in the firmware of Moxa EDS and IKS switches. This may allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves the plaintext transmission of sensitive data, which could include administrative passwords.

Recommendations For Moxa EDS versions 3.8 and prior, update to a version that includes encryption for sensitive data transmission. For Moxa IKS-G6824A series versions 4.5 and prior, update to a version that includes encryption for sensitive data transmission. As a temporary workaround, consider restricting access to the switches to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

BDU:2019-01124

CVE-2019-6526

Affected Products

Moxa Eds

Moxa Iks-G6824A

References · 5

• https://bdu.fstec.ru/vul/2019-01124 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6526 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 · Note
• https://moxa.com/en/support/product-support/security-advisory/eds-405a-series-eds-408a-series-eds-510a-series-and-iks-g6824a-series-ethernet-switches-vulnerabilities · Note