Your one-stop web resource providing safety and security information to manufacturers

Moxa has new firmware to mitigate multiple vulnerabilities in its IKS, EDS, according to a report with NCCIC.

The vulnerabilities are a classic buffer overflow, cross-site request forgery, cross-site scripting, improper access controls, improper restriction of excessive authentication attempts, missing encryption of sensitive data, out-of-bounds read, unprotected storage of credentials, predictable from observable state, and uncontrolled resource consumption.

RELATED STORIES
WinCC OA Licensing Software Holes Filled
Wind River, GE Update 6-year-old Holes
Rockwell Working on PowerMonitor 1000 Fix
Horner Clears Cscape Vulnerability

Successful exploitation of these remotely exploitable vulnerabilities, discovered by Ivan B, Sergey Fedonin, and Vyacheslav Moskvin of Positive Technologies Security, could allow the reading of sensitive information, remote code execution, arbitrary configuration changes, authentication bypass, sensitive data capture, reboot of the device, device crash, or full compromise of the device.

The following Moxa industrial switches are affected:
• IKS-G6824A series Versions 4.5 and prior
• EDS-405A series Version 3.8 and prior
• EDS-408A series Version 3.8 and prior
• EDS-510A series Version 3.8 and prior

Schneider Bold

Several buffer overflow vulnerabilities have been identified, which may allow remote code execution.

CVE-2019-6557 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

Another vulnerability is a cross-site request forgery, which may allow for the execution of unauthorized actions on the device.

CVE-2019-6561 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.6.

In addition, the device fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.

CVE-2019-6565 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.6.

Also, the device does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes.

CVE-2019-6520 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.1.

Moreover, the devices do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack.

CVE-2019-6524 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In addition, the devices use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password.

CVE-2019-6526 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

Also, a failure to properly check array bounds may allow an attacker to read device memory on arbitrary addresses, which may allow an attacker to retrieve sensitive data or cause device reboot.

CVE-2019-6522 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.1.

Moreover, the devices store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.

CVE-2019-6518 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

Also, the software generates a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator’s password, which could lead to a full compromise of the device.

CVE-2019-6563 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In addition, the devices allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash.

CVE-2019-6559 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

The product sees use mainly in the critical manufacturing, energy, and transportation systems sectors. It also sees action on a global basis.

No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities.

Moxa said users should implement the following measures to mitigate these vulnerabilities:
• Install firmware patch. Patches may be requested from Moxa Customer Service (login required).
• Disable web console access in IKS and use another console such as SNMP/Telnet/CLI instead.
• Set EDS series Web configuration as “https only” to reduce predictable session ID concern.

Pin It on Pinterest

Share This