Details of VAR-201903-0185

ID

VAR-201903-0185

CVE

CVE-2019-6561

TITLE

Moxa IKS and EDS Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2019-002200

DESCRIPTION

Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device. MoxaIKS and EDS are Moxa's line of industrial switches. An attacker could exploit the vulnerability to perform unauthorized actions on the device. Moxa IKS and EDS are prone to following security vulnerabilities: 1. A cross-site-scripting vulnerability 2. Multiple stack-based buffer-overflow vulnerabilities 3. A security vulnerability 4. An information disclosure vulnerability 5. A cross-site request-forgery vulnerability 6. Multiple denial-of-service vulnerabilities 7. A security-bypass vulnerability 8. An authentication bypass vulnerability An attacker may leverage these issues to view arbitrary files within the context of the web server, execute arbitrary script code in the browser of the victim in the context of the affected site, steal cookie-based authentication credentials, gain access to sensitive information, compromise the application, access or modify data, reboot or crash of the application resulting in a denial of service condition, bypass security restrictions, or execute arbitrary code. This may lead to other vulnerabilities. The following Moxa products and versions are affected: IKS-G6824A series versions 4.5 and prior, EDS-405A series versions 3.8 and prior, EDS-408A series versions 3.8 and prior, and EDS-510A series versions 3.8 and prior. Moxa IKS-G6824A series are all products of Moxa Company in Taiwan, China. IKS-G6824A series is a series of rack-mount Ethernet switches. EDS-405A series is an EDS-405A series Ethernet switch. EDS-408A series is an EDS-408A series Ethernet switch

Trust: 2.79

sources: NVD: CVE-2019-6561 // JVNDB: JVNDB-2019-002200 // CNVD: CNVD-2019-06177 // BID: 107178 // IVD: ed923030-6378-4e47-850e-003a04af5c17 // VULHUB: VHN-157996 // VULMON: CVE-2019-6561

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: ed923030-6378-4e47-850e-003a04af5c17 // CNVD: CNVD-2019-06177

AFFECTED PRODUCTS

vendor:	moxa	model:	eds-405a	scope:	lte	version:	3.8	Trust: 1.0
vendor:	moxa	model:	eds-408a	scope:	lte	version:	3.8	Trust: 1.0
vendor:	moxa	model:	iks-g6824a	scope:	lte	version:	4.5	Trust: 1.0
vendor:	moxa	model:	eds-510a	scope:	lte	version:	3.8	Trust: 1.0
vendor:	moxa	model:	eds-405a series	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	eds-408a series	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	eds-510a series	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	iks-g6824a series	scope:	-	version:	-	Trust: 0.8
vendor:	moxa	model:	iks-g6824a	scope:	lte	version:	<=4.5	Trust: 0.6
vendor:	moxa	model:	eds-405a	scope:	lte	version:	<=3.8	Trust: 0.6
vendor:	moxa	model:	eds-408a	scope:	lte	version:	<=3.8	Trust: 0.6
vendor:	moxa	model:	eds-510a	scope:	lte	version:	<=3.8	Trust: 0.6
vendor:	moxa	model:	iks-g6824a	scope:	eq	version:	4.5	Trust: 0.3
vendor:	moxa	model:	eds-510a	scope:	eq	version:	3.8	Trust: 0.3
vendor:	moxa	model:	eds-408a	scope:	eq	version:	3.8	Trust: 0.3
vendor:	moxa	model:	eds-405a	scope:	eq	version:	3.8	Trust: 0.3
vendor:	iks g6824a	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	eds 405a	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	eds 408a	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	eds 510a	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: ed923030-6378-4e47-850e-003a04af5c17 // CNVD: CNVD-2019-06177 // BID: 107178 // JVNDB: JVNDB-2019-002200 // NVD: CVE-2019-6561

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-6561
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-6561
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-06177
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201902-964
value:	HIGH
Trust: 0.6
IVD:	ed923030-6378-4e47-850e-003a04af5c17
value:	HIGH
Trust: 0.2
VULHUB:	VHN-157996
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2019-6561
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-6561
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-06177
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	ed923030-6378-4e47-850e-003a04af5c17
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-157996
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-6561
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-6561
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: ed923030-6378-4e47-850e-003a04af5c17 // CNVD: CNVD-2019-06177 // VULHUB: VHN-157996 // VULMON: CVE-2019-6561 // JVNDB: JVNDB-2019-002200 // CNNVD: CNNVD-201902-964 // NVD: CVE-2019-6561

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-157996 // JVNDB: JVNDB-2019-002200 // NVD: CVE-2019-6561

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201902-964

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201902-964

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-002200

PATCH

title:	Top Page	url:	https://www.moxa.com/en/	Trust: 0.8
title:	Patch for MoxaIKS and EDS cross-site request forgery vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/155221	Trust: 0.6
title:	Multiple Moxa Repair measures for product cross-site request forgery vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89679	Trust: 0.6

sources: CNVD: CNVD-2019-06177 // JVNDB: JVNDB-2019-002200 // CNNVD: CNNVD-201902-964

EXTERNAL IDS

db:	NVD	id:	CVE-2019-6561	Trust: 3.7
db:	ICS CERT	id:	ICSA-19-057-01	Trust: 3.5
db:	BID	id:	107178	Trust: 2.1
db:	CNNVD	id:	CNNVD-201902-964	Trust: 0.9
db:	CNVD	id:	CNVD-2019-06177	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-002200	Trust: 0.8
db:	AUSCERT	id:	ESB-2019.0597	Trust: 0.6
db:	IVD	id:	ED923030-6378-4E47-850E-003A04AF5C17	Trust: 0.2
db:	VULHUB	id:	VHN-157996	Trust: 0.1
db:	VULMON	id:	CVE-2019-6561	Trust: 0.1

sources: IVD: ed923030-6378-4e47-850e-003a04af5c17 // CNVD: CNVD-2019-06177 // VULHUB: VHN-157996 // VULMON: CVE-2019-6561 // BID: 107178 // JVNDB: JVNDB-2019-002200 // CNNVD: CNNVD-201902-964 // NVD: CVE-2019-6561

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-19-057-01	Trust: 3.6
url:	http://www.securityfocus.com/bid/107178	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-6561	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6561	Trust: 0.8
url:	https://www.us-cert.gov/ics/advisories/icsa-19-057-01	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/76138	Trust: 0.6
url:	http://www.moxastore.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/352.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2019-06177 // VULHUB: VHN-157996 // VULMON: CVE-2019-6561 // BID: 107178 // JVNDB: JVNDB-2019-002200 // CNNVD: CNNVD-201902-964 // NVD: CVE-2019-6561

CREDITS

Ivan B, Sergey Fedonin, and Vyacheslav Moskvin of Positive Technologies Security reported these vulnerabilities to NCCIC.

Trust: 0.6

sources: CNNVD: CNNVD-201902-964

SOURCES

db:	IVD	id:	ed923030-6378-4e47-850e-003a04af5c17
db:	CNVD	id:	CNVD-2019-06177
db:	VULHUB	id:	VHN-157996
db:	VULMON	id:	CVE-2019-6561
db:	BID	id:	107178
db:	JVNDB	id:	JVNDB-2019-002200
db:	CNNVD	id:	CNNVD-201902-964
db:	NVD	id:	CVE-2019-6561

LAST UPDATE DATE

2024-08-14T13:26:52.405000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-06177	date:	2019-03-05T00:00:00
db:	VULHUB	id:	VHN-157996	date:	2022-11-30T00:00:00
db:	VULMON	id:	CVE-2019-6561	date:	2019-10-09T00:00:00
db:	BID	id:	107178	date:	2019-02-26T00:00:00
db:	JVNDB	id:	JVNDB-2019-002200	date:	2019-04-04T00:00:00
db:	CNNVD	id:	CNNVD-201902-964	date:	2019-10-25T00:00:00
db:	NVD	id:	CVE-2019-6561	date:	2022-11-30T22:18:47.367

SOURCES RELEASE DATE

db:	IVD	id:	ed923030-6378-4e47-850e-003a04af5c17	date:	2019-03-05T00:00:00
db:	CNVD	id:	CNVD-2019-06177	date:	2019-03-05T00:00:00
db:	VULHUB	id:	VHN-157996	date:	2019-03-05T00:00:00
db:	VULMON	id:	CVE-2019-6561	date:	2019-03-05T00:00:00
db:	BID	id:	107178	date:	2019-02-26T00:00:00
db:	JVNDB	id:	JVNDB-2019-002200	date:	2019-04-04T00:00:00
db:	CNNVD	id:	CNNVD-201902-964	date:	2019-02-26T00:00:00
db:	NVD	id:	CVE-2019-6561	date:	2019-03-05T20:29:00.513