Lucene search

[email protected]CVE-2020-6989

HistoryMar 24, 2020 - 7:15 p.m.

CVE-2020-6989

2020-03-2419:15:21

CWE-121

CWE-787

[email protected]

web.nvd.nist.gov

moxa

pt-7528

pt-7828

firmware

vulnerability

buffer overflow

remote attack

denial-of-service

arbitrary code execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attackers to cause a denial-of-service condition or execute arbitrary code.

Affected configurations

NVD

Node

moxapt-7528-24tx-hv_firmwareRange≤4.0

AND

moxapt-7528-24tx-hvMatch-

Node

moxapt-7528-24tx-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-24tx-hv-hvMatch-

Node

moxapt-7528-24tx-wv_firmwareRange≤4.0

AND

moxapt-7528-24tx-wvMatch-

Node

moxapt-7528-24tx-wv-hv_firmwareRange≤4.0

AND

moxapt-7528-24tx-wv-hvMatch-

Node

moxapt-7528-24tx-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-24tx-wv-wvMatch-

Node

moxapt-7528-12msc-12tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-12msc-12tx-4gsfp-hvMatch-

Node

moxapt-7528-12msc-12tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-12msc-12tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-12msc-12tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-12msc-12tx-4gsfp-wvMatch-

Node

moxapt-7528-12msc-12tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-12msc-12tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-12mst-12tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-12mst-12tx-4gsfp-hvMatch-

Node

moxapt-7528-12mst-12tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-12mst-12tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-12mst-12tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-12mst-12tx-4gsfp-wvMatch-

Node

moxapt-7528-12mst-12tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-12mst-12tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-16msc-8tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-16msc-8tx-4gsfp-hvMatch-

Node

moxapt-7528-16msc-8tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-16msc-8tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-16msc-8tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-16msc-8tx-4gsfp-wvMatch-

Node

moxapt-7528-16msc-8tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-16msc-8tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-16mst-8tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-16mst-8tx-4gsfp-hvMatch-

Node

moxapt-7528-16mst-8tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-16mst-8tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-16mst-8tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-16mst-8tx-4gsfp-wvMatch-

Node

moxapt-7528-16mst-8tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-16mst-8tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-20msc-4tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-20msc-4tx-4gsfp-hvMatch-

Node

moxapt-7528-20msc-4tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-20msc-4tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-20msc-4tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-20msc-4tx-4gsfp-wvMatch-

Node

moxapt-7528-20msc-4tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-20msc-4tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-20mst-4tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-20mst-4tx-4gsfp-hvMatch-

Node

moxapt-7528-20mst-4tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-20mst-4tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-20mst-4tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-20mst-4tx-4gsfp-wvMatch-

Node

moxapt-7528-20mst-4tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-20mst-4tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-8msc-16tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-8msc-16tx-4gsfp-hvMatch-

Node

moxapt-7528-8msc-16tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-8msc-16tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-8msc-16tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-8msc-16tx-4gsfp-wvMatch-

Node

moxapt-7528-8msc-16tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-8msc-16tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-8mst-16tx-4gsfp-hv_firmwareRange≤4.0

AND

moxapt-7528-8mst-16tx-4gsfp-hvMatch-

Node

moxapt-7528-8mst-16tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-8mst-16tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-8mst-16tx-4gsfp-wv_firmwareRange≤4.0

AND

moxapt-7528-8mst-16tx-4gsfp-wvMatch-

Node

moxapt-7528-8mst-16tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-8mst-16tx-4gsfp-wv-wvMatch-

Node

moxapt-7528-8ssc-16tx-4gsfp-hv-hv_firmwareRange≤4.0

AND

moxapt-7528-8ssc-16tx-4gsfp-hv-hvMatch-

Node

moxapt-7528-8ssc-16tx-4gsfp-wv-wv_firmwareRange≤4.0

AND

moxapt-7528-8ssc-16tx-4gsfp-wv-wvMatch-

Node

moxapt-7828-f-24_firmwareRange≤3.9

AND

moxapt-7828-f-24Match-

Node

moxapt-7828-f-24-24_firmwareRange≤3.9

AND

moxapt-7828-f-24-24Match-

Node

moxapt-7828-f-24-hv_firmwareRange≤3.9

AND

moxapt-7828-f-24-hvMatch-

Node

moxapt-7828-f-48_firmwareRange≤3.9

AND

moxapt-7828-f-48Match-

Node

moxapt-7828-f-48-48_firmwareRange≤3.9

AND

moxapt-7828-f-48-48Match-

Node

moxapt-7828-f-48-hv_firmwareRange≤3.9

AND

moxapt-7828-f-48-hvMatch-

Node

moxapt-7828-f-hv_firmwareRange≤3.9

AND

moxapt-7828-f-hvMatch-

Node

moxapt-7828-f-hv-hv_firmwareRange≤3.9

AND

moxapt-7828-f-hv-hvMatch-

Node

moxapt-7828-r-24_firmwareRange≤3.9

AND

moxapt-7828-r-24Match-

Node

moxapt-7828-r-24-24_firmwareRange≤3.9

AND

moxapt-7828-r-24-24Match-

Node

moxapt-7828-r-24-hv_firmwareRange≤3.9

AND

moxapt-7828-r-24-hvMatch-

Node

moxapt-7828-r-48_firmwareRange≤3.9

AND

moxapt-7828-r-48Match-

Node

moxapt-7828-r-48-48_firmwareRange≤3.9

AND

moxapt-7828-r-48-48Match-

Node

moxapt-7828-r-48-hv_firmwareRange≤3.9

AND

moxapt-7828-r-48-hvMatch-

Node

moxapt-7828-r-hv_firmwareRange≤3.9

AND

moxapt-7828-r-hvMatch-

Node

moxapt-7828-r-hv-hv_firmwareRange≤3.9

AND

moxapt-7828-r-hv-hvMatch-

CPENameOperatorVersion
moxa:pt-7528-24tx-hv_firmwaremoxa pt-7528-24tx-hv firmwarele4.0

CPE	Name	Operator	Version
moxa:pt-7528-24tx-hv_firmware	moxa pt-7528-24tx-hv firmware	le	4.0

CNA Affected

[
  {
    "product": "Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-20-056-03

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

Related for CVE-2020-6989

nvd1 nessus1 prion1 cvelist1 ics1