// For flags

CVE-2024-12297

Frontend Authorization Logic Disclosure Vulnerability

Severity Score

9.2
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Moxa’s Ethernet switch EDS-508A Series, running firmware version 3.11 and earlier, is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

El conmutador Ethernet de la serie EDS-508A de Moxa, que ejecuta la versión de firmware 3.11 y anteriores, es vulnerable a una omisión de autenticación debido a fallos en su mecanismo de autorización. Aunque en el proceso intervienen tanto la verificación del lado del cliente como la del servidor back-end, los atacantes pueden explotar las debilidades en su implementación. Estas vulnerabilidades pueden permitir ataques de fuerza bruta para adivinar credenciales válidas o ataques de colisión MD5 para falsificar hashes de autenticación, lo que podría comprometer la seguridad del dispositivo.

*Credits: Artem Turyshev from Rosatom Automated Control Systems Joint-Stock Company
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
High
Low
Integrity
High
Low
Availability
High
Low
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-12-06 CVE Reserved
  • 2025-01-15 CVE Published
  • 2025-01-15 CVE Updated
  • 2025-01-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-656: Reliance on Security Through Obscurity
CAPEC
  • CAPEC-49: Password Brute Forcing
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Moxa
Search vendor "Moxa"
 EDS-508A Series
Search vendor "Moxa" for product "EDS-508A Series"
 >= 1.0 <= 3.11
Search vendor "Moxa" for product "EDS-508A Series" and version " >= 1.0 <= 3.11"
en
Affected