PT-2024-3324 · Moxa · Nport 5100A Series

Nicolai Grødum · Published 2024-05-06 · Updated 2024-05-07 · CVE-2024-3576

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NPort 5100A Series versions prior to 1.6

Description The issue exists due to the failure to protect the web page structure, allowing a remote attacker to escalate privileges. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output, which may allow malicious users to obtain sensitive information and escalate privileges.

Recommendations For versions prior to 1.6, upgrade to version 1.6 or later to protect sensitive data and prevent privilege escalation. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation. Avoid using user-controllable input in the affected web server until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-03570

CVE-2024-3576

Affected Products

Nport 5100A Series

References · 8

• https://bdu.fstec.ru/vul/2024-03570 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-246328-nport-5100a-series-store-xss-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3576 · Security Note
• https://twitter.com/CVEnew/status/1787510811360936047 · Twitter Post
• https://t.me/cvenotify/79218 · Telegram Post
• https://t.me/cvenotify/79370 · Telegram Post
• https://twitter.com/linuxpatch/status/1787469284114899336 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787490751577719047 · Twitter Post