Multiple vulnerabilities in Moxa ioLogik 2500 Series Controllers and IOxpress Configuration Utility
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2019-18238 CVE-2020-7003 CVE-2019-18242 |
| CWE-ID | CWE-312 CWE-319 CWE-941 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
ioLogik 2500 Series Hardware solutions / Routers & switches, VoIP, GSM, etc IOxpress Configuration Utility Other software / Other software solutions |
| Vendor | Moxa |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Cleartext storage of sensitive information
EUVDB-ID: #VU25623
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-18238
CWE-ID:
CWE-312 - Cleartext Storage of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to access an administrative account.
The vulnerability exists due to sensitive information is stored in configuration files without encryption. A remote attacker can
obtain credentials.
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsioLogik 2500 Series: 3.0
IOxpress Configuration Utility: 2.3.0
CPE2.3- cpe:2.3:h:moxa:iologik_2500_series:*:*:*:*:*:*:*:*
- cpe:2.3:h:moxa:iologik_2500_series:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:*:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:2.3.0:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-20-056-02
https://www.moxa.com/en/support/support/security-advisory/iologik-2542-hspa-series-ioxpress-vulnerabilities
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Cleartext transmission of sensitive information
EUVDB-ID: #VU25624
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-7003
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsioLogik 2500 Series: 3.0
IOxpress Configuration Utility: 2.3.0
CPE2.3- cpe:2.3:h:moxa:iologik_2500_series:*:*:*:*:*:*:*:*
- cpe:2.3:h:moxa:iologik_2500_series:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:*:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:2.3.0:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-20-056-02
https://www.moxa.com/en/support/support/security-advisory/iologik-2542-hspa-series-ioxpress-vulnerabilities
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Incorrectly Specified Destination in a Communication Channel
EUVDB-ID: #VU25626
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-18242
CWE-ID:
CWE-941 - Incorrectly Specified Destination in a Communication Channel
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the frequent and multiple requests for short-term use. A remote attacker can cause the web server to fail.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsioLogik 2500 Series: 3.0
IOxpress Configuration Utility: 2.3.0
CPE2.3- cpe:2.3:h:moxa:iologik_2500_series:*:*:*:*:*:*:*:*
- cpe:2.3:h:moxa:iologik_2500_series:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:*:*:*:*:*:*:*:*
- cpe:2.3:a:moxa:ioxpress_configuration_utility:2.3.0:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-20-056-02
https://www.moxa.com/en/support/support/security-advisory/iologik-2542-hspa-series-ioxpress-vulnerabilities
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
