CRITICAL🇵🇱 Wersja polska

CVE-2019-6563

CVSS 9.8v3.1pub. 2019-03-05upd. 2024-11-21

Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Moxa Eds 405a

    HW
    Moxa
    all versions

  • Moxa Eds 405a Firmware

    OS
    Moxa
    ≤ 3.8

  • Moxa Eds 408a

    HW
    Moxa
    all versions

  • Moxa Eds 408a Firmware

    OS
    Moxa
    ≤ 3.8

  • Moxa Eds 510a

    HW
    Moxa
    all versions

  • Moxa Eds 510a Firmware

    OS
    Moxa
    ≤ 3.8

  • Moxa Iks G6824a

    HW
    Moxa
    all versions

  • Moxa Iks G6824a Firmware

    OS
    Moxa
    ≤ 4.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2019-6526CRITICAL9.8PL ✓same product

Moxa IKS/EDS — przesyłanie danych wrażliwych bez szyfrowania

CVE-2019-6522CRITICAL9.1PL ✓same product

Błąd sprawdzania granic tablicy w urządzeniach Moxa IKS i EDS — odczyt pamięci

CVE-2019-6524CRITICAL9.8PL ✓same product

Brak blokady prób logowania w przełącznikach Moxa IKS i EDS — brute force

CVE-2019-6557CRITICAL9.8PL ✓same product

Buffer overflow umożliwiający RCE w urządzeniach Moxa IKS i EDS

CVE-2019-6520HIGH7.5same product

Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being abl...