Critical severity · published Jan 15, 2025
CVE-2024-12297
Frontend Authorization Logic Disclosure Vulnerability
9.2
CVSS
0.8%
EPSS
No
On KEV
Description
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
EDS-508A Series · Moxa
1.0 through 3.11 · source: vendor
PS
PT-508 Series · Moxa
1.0 through 3.8 · source: vendor
PS
PT-510 Series · Moxa
1.0 through 3.8 · source: vendor
PS
PT-7528 Series · Moxa
1.0 through 5.0 · source: vendor
PS
PT-7728 Series · Moxa
1.0 through 3.9 · source: vendor
PS
PT-7828 Series · Moxa
1.0 through 4.0 · source: vendor
PS
PT-G503 Series · Moxa
1.0 through 5.3 · source: vendor
PS
PT-G510 Series · Moxa
1.0 through 6.5 · source: vendor
PS
PT-G7728 Series · Moxa
1.0 through 6.5 · source: vendor
PS
PT-G7828 Series · Moxa
1.0 through 6.5 · source: vendor