CVE-2020-6989

EUVD-2020-28129 · Published Mar 24, 2020

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attackers to cause a denial-of-service condition or execute arbitrary code.

Technologies

Moxa Pt-7528-12Msc-12Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-R-48-Hv FirmwareMoxa Pt-7528-24Tx-Hv-HvMoxa Pt-7828-F-24-24Moxa Pt-7828-R-Hv-HvMoxa Pt-7828-F-48Moxa Pt-7528-20Msc-4Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7828-F-Hv FirmwareMoxa Pt-7528-24Tx-HvMoxa Pt-7528-20Mst-4Tx-4Gsfp-HvMoxa Pt-7828-R-48-HvMoxa Pt-7528-12Msc-12Tx-4Gsfp-Hv-HvMoxa Pt-7528-20Mst-4Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-R-24-24Moxa Pt-7828-R-48Moxa Pt-7528-8Msc-16Tx-4Gsfp-Wv FirmwareMoxa Pt-7828-R-24-HvMoxa Pt-7528-8Msc-16Tx-4Gsfp-WvMoxa Pt-7528-16Msc-8Tx-4Gsfp-HvMoxa Pt-7528-16Msc-8Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7528-24Tx-WvMoxa Pt-7528-12Mst-12Tx-4Gsfp-WvMoxa Pt-7528-16Mst-8Tx-4Gsfp-Hv-HvMoxa Pt-7528-8Mst-16Tx-4Gsfp-Hv-HvMoxa Pt-7528-8Ssc-16Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7828-R-24 FirmwareMoxa Pt-7528-24Tx-Hv-Hv FirmwareMoxa Pt-7528-16Mst-8Tx-4Gsfp-WvMoxa Pt-7528-20Msc-4Tx-4Gsfp-Wv-WvMoxa Pt-7528-20Msc-4Tx-4Gsfp-Hv-HvMoxa Pt-7528-20Mst-4Tx-4Gsfp-Hv FirmwareMoxa Pt-7828-R-24-Hv FirmwareMoxa Pt-7528-16Msc-8Tx-4Gsfp-Hv-HvMoxa Pt-7528-20Msc-4Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-F-24 FirmwareMoxa Pt-7528-16Msc-8Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-R-48-48Moxa Pt-7828-F-48 FirmwareMoxa Pt-7528-16Mst-8Tx-4Gsfp-Wv-WvMoxa Pt-7828-F-24-Hv FirmwareMoxa Pt-7828-F-Hv-Hv FirmwareMoxa Pt-7528-20Mst-4Tx-4Gsfp-WvMoxa Pt-7828-F-24-HvMoxa Pt-7528-12Msc-12Tx-4Gsfp-WvMoxa Pt-7528-8Msc-16Tx-4Gsfp-Wv-WvMoxa Pt-7828-R-24Moxa Pt-7528-20Msc-4Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-8Ssc-16Tx-4Gsfp-Hv-HvMoxa Pt-7828-F-24Moxa Pt-7528-8Mst-16Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-8Msc-16Tx-4Gsfp-HvMoxa Pt-7528-12Msc-12Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-12Msc-12Tx-4Gsfp-Wv-WvMoxa Pt-7528-8Mst-16Tx-4Gsfp-Wv FirmwareMoxa Pt-7828-F-48-Hv FirmwareMoxa Pt-7828-R-Hv-Hv FirmwareMoxa Pt-7528-20Msc-4Tx-4Gsfp-WvMoxa Pt-7528-20Mst-4Tx-4Gsfp-Wv-WvMoxa Pt-7528-8Mst-16Tx-4Gsfp-HvMoxa Pt-7528-20Msc-4Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-8Mst-16Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7828-R-48 FirmwareMoxa Pt-7528-12Msc-12Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-8Msc-16Tx-4Gsfp-Hv-HvMoxa Pt-7528-20Msc-4Tx-4Gsfp-HvMoxa Pt-7828-F-HvMoxa Pt-7828-F-48-HvMoxa Pt-7528-24Tx-Hv FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Hv-HvMoxa Pt-7528-8Ssc-16Tx-4Gsfp-Wv-WvMoxa Pt-7528-16Mst-8Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-16Mst-8Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-24Tx-Wv FirmwareMoxa Pt-7828-F-48-48Moxa Pt-7828-R-HvMoxa Pt-7828-F-Hv-HvMoxa Pt-7828-F-48-48 FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-16Mst-8Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-R-48-48 FirmwareMoxa Pt-7528-8Msc-16Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-8Msc-16Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7528-20Mst-4Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-24Tx-Wv-WvMoxa Pt-7528-20Mst-4Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-16Msc-8Tx-4Gsfp-WvMoxa Pt-7828-F-24-24 FirmwareMoxa Pt-7528-24Tx-Wv-Wv FirmwareMoxa Pt-7528-8Msc-16Tx-4Gsfp-Wv-Wv FirmwareMoxa Pt-7528-24Tx-Wv-Hv FirmwareMoxa Pt-7528-16Msc-8Tx-4Gsfp-Wv FirmwareMoxa Pt-7528-8Mst-16Tx-4Gsfp-WvMoxa Pt-7528-16Msc-8Tx-4Gsfp-Wv-WvMoxa Pt-7528-12Mst-12Tx-4Gsfp-HvMoxa Pt-7528-8Mst-16Tx-4Gsfp-Wv-WvMoxa Pt-7528-16Mst-8Tx-4Gsfp-HvMoxa Pt-7528-20Mst-4Tx-4Gsfp-Hv-HvMoxa Pt-7528-16Msc-8Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-24Tx-Wv-HvMoxa Pt-7528-16Mst-8Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-12Msc-12Tx-4Gsfp-Hv FirmwareMoxa Pt-7528-12Mst-12Tx-4Gsfp-Wv-WvMoxa Pt-7528-8Ssc-16Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7828-R-Hv FirmwareMoxa Pt-7528-8Mst-16Tx-4Gsfp-Hv-Hv FirmwareMoxa Pt-7528-12Msc-12Tx-4Gsfp-HvMoxa Pt-7828-R-24-24 Firmware

Weaknesses

CWE-121CWE-787

CVSS scores

v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
v2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://www.us-cert.gov/ics/advisories/icsa-20-056-03

Potentially impacted assets

See if this affects your attack surface