SB2019022609 - Multiple vulnerabilities in Moxa IKS and EDS industrial switches
Published: February 26, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2019-6557)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can send a specially crafted request to the affected system, trigger buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Cross-site request forgery (CVE-ID: CVE-2019-6561)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
3) Cross-site scripting (CVE-ID: CVE-2019-6565)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Improper access control (CVE-ID: CVE-2019-6520)
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions in web interface. A remote attacker can gain unauthorized access to sensitive information.
5) Improper control of interaction frequency (CVE-ID: CVE-2019-6524)
The vulnerability allows a remote attacker to perform brute-force attack.
The vulnerability exists due to the application does not implement sufficient measures to prevent multiple failed authentication attempts, which makes the switches susceptible to brute force attacks.
6) Cleartext transmission of sensitive information (CVE-ID: CVE-2019-6526)
The vulnerability allows a remote attacker to obtain sensitive information.
The vulnerability exists due to Moxa EDS industrial switches use proprietary protocols that cannot be disabled. A remote attacker with ability to perform MitM attack can recover an administrator's password from the unlock function.
7) Out-of-bounds read (CVE-ID: CVE-2019-6522)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A remote attacker can send a specially crafted request to the device, trigger out-of-bounds read error and read contents of memory on the system.
8) Unprotected storage of credentials (CVE-ID: CVE-2019-6518)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
The vulnerability exists due to credentials on device are stored in an insecure manner. A remote authenticated user via web interface can gain access to other users' credentials.
9) Improper Authentication (CVE-ID: CVE-2019-6563)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to authentication cookie is based on MD5 hash of the password. A remote attacker with ability to perform MitM attack can obtain the cookie and recover administrator's password.
10) Input validation error (CVE-ID: CVE-2019-6559)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to input validation error when processing network packets. A remote attacker can send a specially crafted network packet and perform a denial of service (DoS) attack.
11) Stack overflow (CVE-ID: N/A)
12) Improper input validation (CVE-ID: N/A)
Remediation
Install update from vendor's website.