Log in Start free

Vulnerability · Published Jan 15, 2025 · Assigned by Moxa

CVE-2024-12297Frontend Authorization Logic Disclosure Vulnerability

Critical 9.2

In plain English

A critical-severity security flaw in EDS-508A Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

Affected products (as reported)

VendorProductVersions
Moxa EDS-508A Series 1.0 – through 3.11
Moxa PT-508 Series 1.0 – through 3.8
Moxa PT-510 Series 1.0 – through 3.8
Moxa PT-7528 Series 1.0 – through 5.0
Moxa PT-7728 Series 1.0 – through 3.9
Moxa PT-7828 Series 1.0 – through 4.0
Moxa PT-G503 Series 1.0 – through 5.3
Moxa PT-G510 Series 1.0 – through 6.5
Moxa PT-G7728 Series 1.0 – through 6.5
Moxa PT-G7828 Series 1.0 – through 6.5

Weakness: CWE-656 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References