As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.

Product support

Security Advisories

SUMMARY

CVE-2024-12297: Frontend Authorization Logic Disclosure Vulnerability in EDS-508A Series

  • Security Advisory ID: MPSA-241407
  • Version: V1.1
  • Release Date: Jan 15, 2025
  • Reference:

    CVE-2024-12297 (Moxa)

Moxa’s Ethernet switch EDS-508A Series, running firmware version 3.11 and earlier, is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.


The identified vulnerability types and potential impacts are listed below:

Item Vulnerability Type Impact
1

CWE-656: Reliance on Security Through Obscurity (CVE-2024-12297)

Exploitation of this vulnerability could allow attackers to bypass authentication, perform brute-force or MD5 collision attacks, and gain unauthorized access to sensitive configurations or disrupt services.

Vulnerability Scoring Details 

ID
Base Score
Vector

Unauthenticated Remote Exploits

CVE-2024-12297

9.2

AV:N/AC:L/AT:P/PR:N/UI:N/

VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Yes
AFFECTED PRODUCTS AND SOLUTIONS

Affected Products:

The affected products and firmware versions are listed below.

Product Series Affected Versions
EDS-508A Series Firmware version 3.11 and earlier
EDS-510E Series Firmware version 5.5 and earlier
EDS-518E Series Firmware version 6.3 and earlier
EDS-528E Series Firmware version 6.3 and earlier
EDS-G508E Series Firmware version 6.4 and earlier
EDS-G512E Series Firmware version 6.4 and earlier
EDS-G516E Series Firmware version 6.4 and earlier
EDS-P506E Series Firmware version 5.8 and earlier

SDS-3000 Series

(SDS-3006, SDS-3008, SDS-3010, SDS-3016)

Firmware version 3.0 and earlier

SDS-G3000 Series

(SDS-G3006, SDS-G3008, SDS-G3010, SDS-G3016)

Firmware version 3.0 and earlier

 

Solutions:

Moxa has developed appropriate solutions to address vulnerability. The solutions for the affected products are listed below.

Product Series Solutions
EDS-508A Series Please contact Moxa Technical Support for the security patch
EDS-510E Series Upgrade to the firmware version 5.6 or later 
EDS-518E Series Upgrade to the firmware version 6.4 or later 
EDS-528E Series Upgrade to the firmware version 6.4 or later 
EDS-G508E Series Upgrade to the firmware version 6.5 or later 
EDS-G512E Series Upgrade to the firmware version 6.5 or later 
EDS-G516E Series Upgrade to the firmware version 6.5 or later 
EDS-P506E Series Upgrade to the firmware version 5.9 or later 

SDS-3000 Series

(SDS-3006, SDS-3008, SDS-3010, SDS-3016)

Upgrade to the firmware version 3.1 or later 

SDS-G3000 Series

(SDS-G3006, SDS-G3008, SDS-G3010, SDS-G3016)

Upgrade to the firmware version 3.1 or later 

 

Mitigations:

  • Minimize network exposure to ensure the device is not accessible from the Internet.
  • Limit SSH access to trusted IP addresses and networks using firewall rules or TCP wrappers.
  • Implement IDS or Intrusion Prevention System (IPS) to detect and prevent exploitation attempts. These systems can provide an additional layer of defense by monitoring network traffic for signs of attacks.

 

Acknowledgement:

We would like to express our gratitude to Artem Turyshev from Rosatom Automated Control Systems Joint-Stock Company for reporting the vulnerability, collaborating with us to enhance the security of our products, and contributing to our efforts to deliver better service to our customers.

 

Revision History:

VERSION DESCRIPTION RELEASE DATE
1.0 First release January 15, 2025
1.1 Update Affected Products and Solutions: EDS-510E Series, EDS-518E Series, EDS-528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Series, SDS-3000 Series, SDS-G3000 Series July 14, 2025

Relevant Products

EDS-508A Series · EDS-510E Series · EDS-518E Series · EDS-528E Series · EDS-G508E Series · EDS-G512E Series · EDS-G516E Series · EDS-P506E Series · SDS-3006 Series · SDS-3008 Series · SDS-3010 Series · SDS-3016 Series · SDS-G3006 Series · SDS-G3008 Series · SDS-G3010 Series · SDS-G3016 Series ·

  •   Print this page
  • You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
Added To Bag
You have some items waiting in your bag; click here to finish your quote!
Feedback