CVE-2017-13699
HighSummary
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the password encryption method. This method can be retrieved from the firmware as the chall value is sent in cleartext as a POST parameter.
Risk Assessment
An attacker could reverse the password encryption algorithm, leading to the potential exposure of sensitive information. This poses a significant security risk to the devices and the network.
Recommendation
It is recommended to update the firmware to the latest version that addresses this vulnerability and to implement additional security measures, such as stronger password encryption methods.
Other vulnerabilities in MOXA EDS-G512E 5.1 build 16072215
See all- CVE-2017-13698High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices, allowing an attacker to extract public and private keys from the firmware image available on the MOXA website. These keys could be used against a production switch that has the default keys embedded.
- CVE-2017-13703High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices that may lead to a denial of service.
- CVE-2017-13701Critical
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the storage of backup files. These files contain sensitive information insecurely, as passwords are stored without encryption and without salt for hashing.
Original NVD description (English source)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to retrieve it.