Moxa PT G503 Series vulnerabilities

6 vulnerabilities

Known vulnerabilities in Moxa PT G503 Series, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.7CVE-2024-9404moxaeds-405a series+47
EPSS score
0.75%
This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant remote threat, potentially allowing attackers to shut down affected systems.9.4CVE-2024-9137moxaedf-g1002-bp series+59
EPSS score
0.50%
The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.8.7CVE-2024-7695moxaeds-405a series+50
EPSS score
0.72%
Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack.9.2CVE-2024-12297moxaeds-508a series+9
EPSS score
0.85%
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.5.3CVE-2023-4217moxaeds-g503_firmware+1
EPSS score
0.32%
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.5.3CVE-2023-5035moxaeds-g503_firmware+1
EPSS score
0.21%
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.