CVE-2019-6557 - OpenCVE

Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Moxa	Eds-510a Firmware Iks-g6824a Iks-g6824a Firmware Eds-405a Firmware Eds-408a Firmware Eds-405a Eds-510a Eds-408a

Configuration 1 [-]

AND

cpe:2.3:o:moxa:iks-g6824a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:iks-g6824a:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:moxa:eds-405a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-405a:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:moxa:eds-408a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-408a:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:moxa:eds-510a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-510a:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/107178	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01	US Government Resource Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2019-03-05T00:00:00

Updated: 2019-03-06T10:57:01

Reserved: 2019-01-22T00:00:00

Link: CVE-2019-6557

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-03-05T20:29:00.437

Modified: 2022-11-30T22:13:52.450

Link: CVE-2019-6557

JSON object: View

Redhat Information

No data.

CWE

CWE-120

{"containers": {"cna": {"affected": [{"product": "Moxa IKS, EDS", "vendor": "ICS-CERT", "versions": [{"status": "affected", "version": "IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior"}]}], "datePublic": "2019-03-05T00:00:00", "descriptions": [{"lang": "en", "value": "Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "Buffer overflow CWE-120", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-03-06T10:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01"}, {"name": "107178", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107178"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2019-03-05T00:00:00", "ID": "CVE-2019-6557", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Moxa IKS, EDS", "version": {"version_data": [{"version_value": "IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior"}]}}]}, "vendor_name": "ICS-CERT"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Buffer overflow CWE-120"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01"}, {"name": "107178", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107178"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2019-6557", "datePublished": "2019-03-05T00:00:00", "dateReserved": "2019-01-22T00:00:00", "dateUpdated": "2019-03-06T10:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:iks-g6824a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0315E6E6-AD90-4B57-8A2C-23A435CDD9A1", "versionEndIncluding": "4.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:iks-g6824a:-:*:*:*:*:*:*:*", "matchCriteriaId": "4A845716-E0AF-4DF3-AFAD-2D19456ACAEE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-405a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "24BC0C6E-9FD5-4956-8A9A-CFEB597638D7", "versionEndIncluding": "3.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-405a:-:*:*:*:*:*:*:*", "matchCriteriaId": "66C5DF82-A91D-4966-A841-5B5235316ED4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-408a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "79E6E8C1-ABB6-4FA1-87BC-338131D9C8FA", "versionEndIncluding": "3.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-408a:-:*:*:*:*:*:*:*", "matchCriteriaId": "316407E3-51E2-4622-99CE-B683B91741D3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-510a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C2BF052-733D-4B18-8D4F-A8E9E27D5980", "versionEndIncluding": "3.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-510a:-:*:*:*:*:*:*:*", "matchCriteriaId": "819581F2-3AF9-4F2A-A9D2-1BDE853C73B9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution."}, {"lang": "es", "value": "Se han identificado varias vulnerabilidades de desbordamiento de b\u00fafer en Moxa IKS y EDS, lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2019-6557", "lastModified": "2022-11-30T22:13:52.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-05T20:29:00.437", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107178"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["US Government Resource", "Third Party Advisory"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}