CVE-2017-13698
HighSummary
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices, allowing an attacker to extract public and private keys from the firmware image available on the MOXA website. These keys could be used against a production switch that has the default keys embedded.
Risk Assessment
The risk to the organization involves the potential compromise of switches, which could lead to unauthorized access to the network and data. The use of default keys increases vulnerability to attacks.
Recommendation
It is recommended to update the device firmware to the latest version and change default keys to unique ones to minimize risk. Additionally, monitoring access to devices and conducting security audits is advised.
Other vulnerabilities in MOXA EDS-G512E 5.1 build 16072215
See all- CVE-2017-13699High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the password encryption method. This method can be retrieved from the firmware as the chall value is sent in cleartext as a POST parameter.
- CVE-2017-13703High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices that may lead to a denial of service.
- CVE-2017-13701Critical
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the storage of backup files. These files contain sensitive information insecurely, as passwords are stored without encryption and without salt for hashing.
Original NVD description (English source)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. An attacker could extract public and private keys from the firmware image available on the MOXA website and could use them against a production switch that has the default keys embedded.