Refine your search
2 vulnerabilities found for PT-510 Series by Moxa
CERTFR-2026-AVI-0458
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans les produits Moxa. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Moxa | PT-510 Series | PT-510 Series versions antérieures à v3.8.12 | ||
| Moxa | PT-G510 Series | PT-G510 Series versions antérieures à v6.5.22 | ||
| Moxa | PT-7828 Series | PT-7828 Series versions antérieures à v4.0.8 | ||
| Moxa | PT-G503 Series | PT-G503 Series versions antérieures à v5.3.12 | ||
| Moxa | PT-G7728 Series | PT-G7728 Series versions antérieures à v6.6 | ||
| Moxa | PT-G7828 Series | PT-G7828 Series versions antérieures à v6.6 | ||
| Moxa | PT-7528 Series | PT-7528 Series versions antérieures à v5.0.34 | ||
| Moxa | PT-7728 Series | PT-7728 Series versions antérieures à v3.9.6 | ||
| Moxa | PT-508 Series | PT-508 Series versions antérieures à v3.8.12 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PT-510 Series versions ant\u00e9rieures \u00e0 v3.8.12",
"product": {
"name": "PT-510 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-G510 Series versions ant\u00e9rieures \u00e0 v6.5.22",
"product": {
"name": "PT-G510 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-7828 Series versions ant\u00e9rieures \u00e0 v4.0.8",
"product": {
"name": "PT-7828 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-G503 Series versions ant\u00e9rieures \u00e0 v5.3.12",
"product": {
"name": "PT-G503 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-G7728 Series versions ant\u00e9rieures \u00e0 v6.6",
"product": {
"name": "PT-G7728 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-G7828 Series versions ant\u00e9rieures \u00e0 v6.6",
"product": {
"name": "PT-G7828 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-7528 Series versions ant\u00e9rieures \u00e0 v5.0.34",
"product": {
"name": "PT-7528 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-7728 Series versions ant\u00e9rieures \u00e0 v3.9.6",
"product": {
"name": "PT-7728 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
},
{
"description": "PT-508 Series versions ant\u00e9rieures \u00e0 v3.8.12",
"product": {
"name": "PT-508 Series",
"vendor": {
"name": "Moxa",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2020-11868",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11868"
}
],
"initial_release_date": "2026-04-20T00:00:00",
"last_revision_date": "2026-04-20T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0458",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-04-20T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Moxa. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Moxa",
"vendor_advisories": [
{
"published_at": "2026-04-20",
"title": "Bulletin de s\u00e9curit\u00e9 Moxa MPSA-258681",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258681-cve-2020-11868-ntp-vulnerability-in-ethernet-switches"
}
]
}
CVE-2024-12297 (GCVE-0-2024-12297)
Vulnerability from cvelistv5
Published
2025-01-15 10:00
Modified
2025-03-06 08:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-656 - Reliance on Security Through Obscurity
Summary
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Moxa | EDS-508A Series |
Version: 1.0 < |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-15T14:49:11.063174Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T14:49:22.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EDS-508A Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "3.11",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-508 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "3.8",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-510 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "3.8",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-7528 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-7728 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "3.9",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-7828 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "4.0",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-G503 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-G510 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "6.5",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-G7728 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "6.5",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT-G7828 Series",
"vendor": "Moxa",
"versions": [
{
"lessThanOrEqual": "6.5",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Artem Turyshev from Rosatom Automated Control Systems Joint-Stock Company"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Moxa\u2019s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.\u003cbr\u003e"
}
],
"value": "Moxa\u2019s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49: Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-656",
"description": "CWE-656: Reliance on Security Through Obscurity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T08:27:52.297Z",
"orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
"shortName": "Moxa"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMoxa has released appropriate solutions to address vulnerability. The solutions for the affected products are listed below.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eEDS-508A Series: Please contact Moxa Technical Support for the security patch\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003ePT Series:\u0026nbsp;Please contact Moxa Technical Support for the security patch\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Moxa has released appropriate solutions to address vulnerability. The solutions for the affected products are listed below.\n\n * EDS-508A Series: Please contact Moxa Technical Support for the security patch\n\n\n * PT Series:\u00a0Please contact Moxa Technical Support for the security patch"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Frontend Authorization Logic Disclosure Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eMinimize network exposure to ensure the device is not accessible from the Internet.\u003c/li\u003e\u003cli\u003eLimit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers. \u003c/li\u003e\u003cli\u003eImplement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks. \u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
}
],
"value": "* Minimize network exposure to ensure the device is not accessible from the Internet.\n * Limit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers. \n * Implement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
"assignerShortName": "Moxa",
"cveId": "CVE-2024-12297",
"datePublished": "2025-01-15T10:00:46.524Z",
"dateReserved": "2024-12-06T04:02:40.742Z",
"dateUpdated": "2025-03-06T08:27:52.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}