CVE-2016-0879
HighSummary
Moxa Secure Router EDR-G903 devices before version 3.4.12 do not delete copies of configuration and log files after completing the import function, allowing remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
Risk Assessment
The organization may be exposed to the disclosure of confidential data, potentially leading to security breaches and loss of customer trust.
Recommendation
It is recommended to update devices to version 3.4.12 or later and implement appropriate security measures to restrict access to configuration and log files.
Other vulnerabilities in Moxa Secure Router EDR-G903
See all- CVE-2016-0878High
Moxa Secure Router EDR-G903 devices before version 3.4.12 are vulnerable to a denial of service (cold start) attack by sending two crafted ping requests.
- CVE-2016-0877High
A memory leak on Moxa Secure Router EDR-G903 devices before version 3.4.12 allows remote attackers to cause a denial of service by executing the ping function.
- CVE-2016-0876High
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
- CVE-2016-0875High
Moxa Secure Router EDR-G903 devices before version 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
Original NVD description (English source)
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.