PT-2021-3065 · Moxa · Nport Ia5150A+3

Alexander Nochvay · Published 2021-04-28 · Updated 2021-05-24 · CVE-2020-27150

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions NPort IA5150A/IA5250A, IA5450A versions (affected versions not specified) NPort IA5000A Series versions (affected versions not specified)

Description The issue is related to the storage of passwords in plaintext. This could allow a remote attacker to gain unauthorized access to sensitive information. The export of a device's configuration may contain user passwords and other sensitive data in their original form if a pre-shared key is not set.

Recommendations For NPort IA5150A/IA5250A, IA5450A, consider setting a pre-shared key to protect sensitive data. For NPort IA5000A Series, set a pre-shared key to prevent the export of sensitive data in plaintext. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-256

Related Identifiers

BDU:2021-02677

CVE-2020-27150

Affected Products

Nport Ia5000A Series

Nport Ia5150A

Nport Ia5250A

Nport Ia5450A

References · 6

• https://moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27150 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27150 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02677 · Security Note
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-019%2C · Note
• https://cybersecurity-help.cz/vdb/SB2021042809 · Note