390 matches found
CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...
CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...
CVE-2024-0387: Initialization of a Resource with an Insecure Default
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...
PT-2024-1844 · Unknown · Eds-4000/G4000 Series
Name of the Vulnerable Software and Affected Versions: EDS-4000/G4000 Series versions prior to 3.2 Description: The issue is related to a bypass of access control mechanisms in the web service of the EDS-4000/G4000 Series managed switch firmware. This could allow a remote attacker to send request...
MOXA EDS-4000/G4000 Series 安全漏洞
MOXA EDS-4000/G4000 Series is a series of industrial managed Ethernet switches from MOXA, China. A security bypass vulnerability exists in MOXA EDS-4000/G4000 Series prior to version 3.2, which originates from a user-deactivatable IP forwarding feature, and can be exploited by an attacker to bypa...
eds-pizza.de Cross Site Scripting vulnerability OBB-3621052
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Moxa IKS, EDS Improper Access Control (CVE-2019-6520)
Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...
Moxa EDS-G512E improper cookie management (CVE-2017-13702)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...
Moxa IKS, EDS Cross-Site Request Forgery (CVE-2019-6561)
Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Moxa EDS-G512E Use of Default Private Keys (CVE-2017-13698)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. An attacker could extract public and private keys from the firmware image available on the MOXA website and could use them against a production switch that has the default keys embedded. This plugin only works with Tenable.ot...
Moxa IKS, EDS Plaintext Storage of a Password (CVE-2019-6518)
Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Moxa EDS Ethernet Switches Uncontrolled Resource Consumption (CVE-2019-19707)
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices with firmware through 6.0, denial of service can occur via PROFINET DCE-RPC endpoint discovery packets. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...
Moxa IKS, EDS Missing Encryption of Sensitive Data (CVE-2019-6526)
Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative...
Moxa EDS-G512E improper password storage in backup files (CVE-2017-13701)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method. This plugin only works with...
Moxa EDS-G516E and EDS-510E Series Ethernet Switches Stack-Based Buffer Overflow (CVE-2020-7007)
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...
Moxa IKS, EDS Out-of-Bounds Read (CVE-2019-6522)
Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot. This plugin only works with Tenable.ot. Please visit...
Moxa EDS-G512E Cross-site Scripting (CVE-2017-13700)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...
Moxa IKS, EDS Improper Neutralization of Input During Web Page Generation (CVE-2019-6565)
Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Moxa EDS-G512E Inadequate Encryption Strength (CVE-2017-13699)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...
Moxa EDS-G516E and EDS-510E Series Ethernet Switches Cleartext Transmission of Sensitive Information (CVE-2020-6997)
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...