CVE-2019-6563: ics-cert moxa iks, eds Predictable from Observable State

Vulnerability summary

CVE-2019-6563 is a high (CVSS 10.0) Predictable from Observable State vulnerability in ics-cert moxa iks, eds. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities.

Timeline

1. 05-03-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.

• CWE-341Predictable from Observable StateA number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
• CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.