CVE-2017-13701
CriticalSummary
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the storage of backup files. These files contain sensitive information insecurely, as passwords are stored without encryption and without salt for hashing.
Risk Assessment
The organization is at risk of unauthorized access to sensitive data, which could lead to serious security breaches. The lack of proper password protection increases the risk of theft.
Recommendation
It is recommended to immediately implement password encryption and use salt for hashing to secure sensitive information. Additionally, consider updating devices to the latest software version.
Other vulnerabilities in MOXA EDS-G512E 5.1 build 16072215
See all- CVE-2017-13699High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the password encryption method. This method can be retrieved from the firmware as the chall value is sent in cleartext as a POST parameter.
- CVE-2017-13698High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices, allowing an attacker to extract public and private keys from the firmware image available on the MOXA website. These keys could be used against a production switch that has the default keys embedded.
- CVE-2017-13703High
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices that may lead to a denial of service.
Original NVD description (English source)
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method.