Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.TENABLE_OT_MOXA_CVE-2020-6993.NASL
HistoryAug 02, 2023 - 12:00 a.m.

Moxa PT-7528 and PT-7828 Series Information Exposure (CVE-2020-6993)

2023-08-0200:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
5
moxa
pt-7528
pt-7828
information exposure
vulnerability
gain access

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

53.0%

JSON

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information from the web service without authorization.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501433);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/08/03");

  script_cve_id("CVE-2020-6993");

  script_name(english:"Moxa PT-7528 and PT-7828 Series Information Exposure (CVE-2020-6993)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828
series firmware, Version 3.9 or lower, an attacker can gain access to
sensitive information from the web service without authorization.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.us-cert.gov/ics/advisories/icsa-20-056-03");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6993");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/08/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-24tx-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-24tx-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-24tx-wv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-24tx-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-24tx-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-wv-wv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-24-24_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-24-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-24_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-48-48_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-48-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-48_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-f-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-24-24_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-24-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-24_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-48-48_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-48-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-48_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-hv-hv_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:pt-7828-r-hv_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Moxa");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Moxa');

var asset = tenable_ot::assets::get(vendor:'Moxa');

var vuln_cpes = {
    "cpe:/o:moxa:pt-7528-24tx-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-24tx-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-24tx-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-24tx-wv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-24tx-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12msc-12tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-12mst-12tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16msc-8tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-16mst-8tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20msc-4tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-20mst-4tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-hv-hv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-wv-wv_firmware" :
        {"versionEndIncluding" : "4.0", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-24_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-24-24_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-24-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-48_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-48-48_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-48-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-f-hv-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-24_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-24-24_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-24-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-48_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-48-48_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-48-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"},
    "cpe:/o:moxa:pt-7828-r-hv-hv_firmware" :
        {"versionEndIncluding" : "3.9", "family" : "PT"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);
VendorProductVersionCPE
moxapt-7528-24tx-wv-hv_firmwarecpe:/o:moxa:pt-7528-24tx-wv-hv_firmware
moxapt-7528-24tx-wv-wv_firmwarecpe:/o:moxa:pt-7528-24tx-wv-wv_firmware
moxapt-7528-8msc-16tx-4gsfp-wv_firmwarecpe:/o:moxa:pt-7528-8msc-16tx-4gsfp-wv_firmware
moxapt-7528-8mst-16tx-4gsfp-hv-hv_firmwarecpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv-hv_firmware
moxapt-7528-8mst-16tx-4gsfp-hv_firmwarecpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-hv_firmware
moxapt-7528-8mst-16tx-4gsfp-wv-wv_firmwarecpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv-wv_firmware
moxapt-7528-8mst-16tx-4gsfp-wv_firmwarecpe:/o:moxa:pt-7528-8mst-16tx-4gsfp-wv_firmware
moxapt-7528-8ssc-16tx-4gsfp-hv-hv_firmwarecpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-hv-hv_firmware
moxapt-7528-8ssc-16tx-4gsfp-wv-wv_firmwarecpe:/o:moxa:pt-7528-8ssc-16tx-4gsfp-wv-wv_firmware
moxapt-7828-f-24-24_firmwarecpe:/o:moxa:pt-7828-f-24-24_firmware
Rows per page:
1-10 of 551

Related

cvelist 1
cve 1
prion 1
nvd 1
ics 1
cvelist
cvelist
CVE-2020-6993
2020-03-24 19:19:09
cve
cve
CVE-2020-6993
2020-03-24 20:15:15
prion
prion
Authorization
2020-03-24 20:15:00
nvd
nvd
CVE-2020-6993
2020-03-24 20:15:15
ics
ics
Moxa PT-7528 and PT-7828 Series Ethernet Switches
2020-02-25 12:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

53.0%

JSON
Related for TENABLE_OT_MOXA_CVE-2020-6993.NASL
cvelist1cve1prion1nvd1ics1