CVE-2024-0387

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 3.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0	Vendor Advisory
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:moxa:eds-4008_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-4008:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:moxa:eds-4009_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-4009:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:moxa:eds-4012_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-4012:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:moxa:eds-4014_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-4014:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:moxa:eds-g4008_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-g4008:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:moxa:eds-g4012_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-g4012:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:moxa:eds-g4014_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:eds-g4014:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-26 16:27

Updated : 2025-02-25 22:56

NVD link : CVE-2024-0387

Mitre link : CVE-2024-0387

CVE.ORG link : CVE-2024-0387

JSON object : View

Products Affected

moxa

eds-g4012_firmware
eds-g4014
eds-g4014_firmware
eds-4014_firmware
eds-g4008_firmware
eds-g4008
eds-g4012
eds-4012
eds-4009_firmware
eds-4008
eds-4008_firmware
eds-4009
eds-4012_firmware
eds-4014

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

NVD-CWE-noinfo

{"id": "CVE-2024-0387", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-02-26T16:27:49.890", "references": [{"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1188"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests."}, {"lang": "es", "value": "Las series EDS-4000/G4000 anteriores a la versi\u00f3n 3.2 incluyen capacidades de reenv\u00edo de IP que los usuarios no pueden desactivar. Un atacante puede enviar solicitudes al producto y reenviarlas al objetivo. Un atacante puede eludir los controles de acceso u ocultar el origen de solicitudes maliciosas."}], "lastModified": "2025-02-25T22:56:10.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-4008_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89DD059E-1681-4630-8625-94C7A8B4D506", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-4008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F818164F-C5F1-4CBC-8907-46F717892C84"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-4009_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "180A8D5C-F082-4B20-9B66-56EF41CF4D6A", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-4009:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E9CF7E31-A0C2-4A65-90B5-FEFA2D15D721"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-4012_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF60F4C-6201-485F-8419-5DB64B553AF4", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-4012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "25139ECE-9CCB-4140-9CF9-2FEE850FB700"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-4014_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E026B16A-2FEE-426C-93D0-AFB96EAA3BF3", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-4014:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "336F6F54-B7C8-47CD-A44D-8A565A43042F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-g4008_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9526A65-BC53-457F-B0D3-CCC19D2B21CD", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-g4008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "75630512-8D7A-4E40-BA04-315C3E88EC86"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-g4012_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCDEF4E7-C21E-4B32-BCC5-72D07B09D9D6", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-g4012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5F057F41-E437-4946-9CDF-796B6ACDE613"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-g4014_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2194CCFD-1E93-43DD-8586-3B160590A1C5", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-g4014:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9E670263-13B4-4E1A-8D02-B119F5940604"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}