Critical severity · published Jan 15, 2025
CVE-2024-12297
Frontend Authorization Logic Disclosure Vulnerability
9.2
CVSS
0.8%
EPSS
No
On KEV
Description
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
EDS-508A Series · Moxa
1.0 through 3.11 · source: vendor
PS
PT-508 Series · Moxa
1.0 through 3.8 · source: vendor
PS
PT-510 Series · Moxa
1.0 through 3.8 · source: vendor
PS
PT-7528 Series · Moxa
1.0 through 5.0 · source: vendor
PS
PT-7728 Series · Moxa
1.0 through 3.9 · source: vendor
PS
PT-7828 Series · Moxa
1.0 through 4.0 · source: vendor
PS
PT-G503 Series · Moxa
1.0 through 5.3 · source: vendor
PS
PT-G510 Series · Moxa
1.0 through 6.5 · source: vendor
PS
PT-G7728 Series · Moxa
1.0 through 6.5 · source: vendor
PS
PT-G7828 Series · Moxa
1.0 through 6.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12297
www.moxa.com
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series
www.moxa.com
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches
More from EDS-508A Series
9.4
CVE-2024-9137
Moxa Service Missing Authentication for Critical Function
7.5
CVE-2024-7695
Out-of-bounds Write Vulnerability
7.5
CVE-2024-9404
Denial-of-Service Vulnerability
