CVE-2024-12297: moxa eds-508a series Reliance on Security Through Obscurity

Vulnerability summary

CVE-2024-12297 is a critical (CVSS 9.2) Reliance on Security Through Obscurity vulnerability in moxa eds-508a series. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.6% of scored vulnerabilities.

Timeline

1. 15-01-2025
   PublishedVulnerability first disclosed.
2. 06-03-2025
   Last modifiedVulnerability information updated.

Description

Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

• CWE-656Reliance on Security Through ObscurityThe product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.