CVE-2019-18238

Published: Feb 26, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration files without encryption, which may allow an attacker to access an administrative account.

Affected (20)

Moxa

20 products

Iologik 2512 Firmware

Iologik 2512 T Firmware

Iologik 2512 Hspa Firmware

Iologik 2512 Hspa T Firmware

Iologik 2512 Wl1 Eu Firmware

Iologik 2512 Wl1 Eu T Firmware

Iologik 2512 Wl1 Us Firmware

Iologik 2512 Wl1 Us T Firmware

Iologik 2512 Wl1 Jp Firmware

Iologik 2512 Wl1 Jp T Firmware

Iologik 2542 Firmware

Iologik 2542 T Firmware

Iologik 2542 Hspa Firmware

Iologik 2542 Hspa T Firmware

Iologik 2542 Wl1 Eu Firmware

Iologik 2542 Wl1 Eu T Firmware

Iologik 2542 Wl1 Us Firmware

Iologik 2542 Wl1 Us T Firmware

Iologik 2542 Wl1 Jp Firmware

Iologik 2542 Wl1 Jp T Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 T	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Hspa Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Hspa	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Hspa T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Hspa T	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Eu Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Eu	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Eu T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Eu T	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Us Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Us	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Us T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Us T	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Jp Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Jp	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2512 Wl1 Jp T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2512 Wl1 Jp T	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 T	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Hspa Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Hspa	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Hspa T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Hspa T	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Eu Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Eu	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Eu T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Eu T	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Us Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Us	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Us T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Us T	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Jp Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Jp	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Moxa Iologik 2542 Wl1 Jp T Firmware	Up to 3.0

Running on/with	Platform Versions
Moxa Iologik 2542 Wl1 Jp T	All versions

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (2)

https://www.us-cert.gov/ics/advisories/icsa-20-056-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsa-20-056-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.