PT-2017-3817 · Moxa · Moxa Pt-7528+1

Published 2017-09-01 · Updated 2020-03-26 · CVE-2020-6995

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa PT-7528 series firmware versions 4.0 and earlier Moxa PT-7828 series firmware versions 3.9 and earlier

Description The issue is related to weak password requirements in the firmware, which may allow an attacker to gain unauthorized access. Additionally, the vulnerability is associated with a lack of restrictions on excessive authentication attempts, potentially enabling a remote attacker to bypass existing security restrictions using a brute force attack.

Recommendations For Moxa PT-7528 series firmware versions 4.0 and earlier, consider updating to a version higher than 4.0 to strengthen password requirements and mitigate the risk of unauthorized access. For Moxa PT-7828 series firmware versions 3.9 and earlier, consider updating to a version higher than 3.9 to strengthen password requirements and mitigate the risk of unauthorized access. As a temporary workaround, consider implementing additional security measures to restrict excessive authentication attempts and minimize the risk of brute force attacks.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2019-03281

CVE-2020-6995

Affected Products

Moxa Pt-7528

Moxa Pt-7828

References · 5

• https://osv.dev/vulnerability/CVE-2020-6995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6995 · Security Note
• https://bdu.fstec.ru/vul/2019-03281 · Security Note
• https://us-cert.gov/ics/advisories/icsa-20-056-03 · Note
• https://moxa.com/en/support/support/security-advisory/pt-7528-7828-ethernet-switches-vulnerabilities · Note