CVE-2019-6526: moxa eds-405a_firmware Missing Encryption of Sensitive Data
Vulnerability summary
CVE-2019-6526 is a critical (CVSS 9.8) Missing Encryption of Sensitive Data vulnerability in moxa eds-405a_firmware. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.1% of scored vulnerabilities.
Timeline
- 12-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 1.00% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected systems
Moxa5 products
- eds-405a_firmware≤ 3.8
- eds-408a_firmware≤ 3.8
- eds-510a_firmware≤ 3.8
- iks, edsIKS-G6824A series Versions 4.5 and prior | EDS-405A series Version 3.8 and prior | EDS-408A series Version 3.8 and prior | and EDS-510A series Version 3.8 and prior
- iks-g6824a_firmware≤ 4.5
1 vendor · 5 products
References
1 links- ics-cert.us-cert.gov/advisories/ICSA-19-057-01X Refsource MISCThird Party AdvisoryUS Government Resource