A vulnerability, which was classified as problematic, was found in Moxa EDS-405A and EDS-408A up to 3.5 (Automation Software). This affects an unknown functionality of the component Diagnosis Ping. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field.

The weakness was presented 09/11/2015 (Website). The advisory is shared at ics-cert.us-cert.gov. This vulnerability is uniquely identified as CVE-2015-6466 since 08/17/2015. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 3.6 eliminates this vulnerability.

See 77671 and 77672 for similar entries.

Productinfo

Type

• Automation Software

Vendor

• Moxa

Name

• EDS-405A
• EDS-408A

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion