PT-2021-16818 · Moxa · Moxa Camera Vport 06Ec-2V Series

Qian Chen · Published 2021-05-10 · Updated 2021-05-18 · CVE-2021-25848

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Moxa Camera VPort 06EC-2V Series version 1.1

Description The issue arises from improper validation of the length field of LLDP-MED TLV in the userdisk/vport lldpd component, allowing information disclosure to attackers. This occurs due to the use of a fixed loop counter variable without checking the actual available length, which can be exploited via a crafted LLDP packet.

Recommendations For Moxa Camera VPort 06EC-2V Series version 1.1, consider implementing proper length validation for LLDP-MED TLV to prevent information disclosure. As a temporary workaround, restrict access to the userdisk/vport lldpd component to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-25848

Affected Products

Moxa Camera Vport 06Ec-2V Series

References · 4

• https://osv.dev/vulnerability/CVE-2021-25848 · Vendor Advisory
• https://moxa.com/en · Vendor Advisory
• https://moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25848 · Security Note