Vulnerability-Lookup - Search a vulnerability

Severity ?

9.2 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CWE

CWE-656 - Reliance on Security Through Obscurity

Summary

Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

References

▼	URL	Tags
	https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series	vendor-advisory
	https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Moxa

EDS-508A Series

Version: 1.0 <

Moxa	PT-508 Series	Version: 1.0 <
Moxa	PT-510 Series	Version: 1.0 <
Moxa	PT-7528 Series	Version: 1.0 <
Moxa	PT-7728 Series	Version: 1.0 <
Moxa	PT-7828 Series	Version: 1.0 <
Moxa	PT-G503 Series	Version: 1.0 <
Moxa	PT-G510 Series	Version: 1.0 <
Moxa	PT-G7728 Series	Version: 1.0 <
Moxa	PT-G7828 Series	Version: 1.0 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-15T14:49:11.063174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-15T14:49:22.117Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EDS-508A Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.11",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-508 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.8",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-510 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.8",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-7528 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "5.0",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-7728 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.9",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-7828 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-G503 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "5.3",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-G510 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "6.5",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-G7728 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "6.5",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PT-G7828 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "6.5",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Artem Turyshev from Rosatom Automated Control Systems Joint-Stock Company"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Moxa\u2019s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.\u003cbr\u003e"
            }
          ],
          "value": "Moxa\u2019s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-49",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-49: Password Brute Forcing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-656",
              "description": "CWE-656: Reliance on Security Through Obscurity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-06T08:27:52.297Z",
        "orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
        "shortName": "Moxa"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMoxa has released appropriate solutions to address vulnerability. The solutions for the affected products are listed below.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eEDS-508A Series: Please contact Moxa Technical Support for the security patch\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003ePT Series:\u0026nbsp;Please contact Moxa Technical Support for the security patch\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Moxa has released appropriate solutions to address vulnerability. The solutions for the affected products are listed below.\n\n  *  EDS-508A Series: Please contact Moxa Technical Support for the security patch\n\n\n  *  PT Series:\u00a0Please contact Moxa Technical Support for the security patch"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Frontend Authorization Logic Disclosure Vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003cli\u003eMinimize network exposure to ensure the device is not accessible from the Internet.\u003c/li\u003e\u003cli\u003eLimit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers. \u003c/li\u003e\u003cli\u003eImplement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks. \u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "*  Minimize network exposure to ensure the device is not accessible from the Internet.\n  *  Limit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers. \n  *  Implement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
    "assignerShortName": "Moxa",
    "cveId": "CVE-2024-12297",
    "datePublished": "2025-01-15T10:00:46.524Z",
    "dateReserved": "2024-12-06T04:02:40.742Z",
    "dateUpdated": "2025-03-06T08:27:52.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}