CVE-2019-6563
EUVD-2019-1612205.03.2019, 20:29
Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| moxa | iks-g6824a_firmware | 𝑥 ≤ 4.5 |
| moxa | eds-405a_firmware | 𝑥 ≤ 3.8 |
| moxa | eds-408a_firmware | 𝑥 ≤ 3.8 |
| moxa | eds-510a_firmware | 𝑥 ≤ 3.8 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-341 - Predictable from Observable StateA number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
- CWE-916 - Use of Password Hash With Insufficient Computational EffortThe software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.