6.5

CVE-2024-0387

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moxa ≫ Eds-4008 Firmware Version <= 3.2
   Moxa ≫ Eds-4008 Version-
Moxa ≫ Eds-4009 Firmware Version <= 3.2
   Moxa ≫ Eds-4009 Version-
Moxa ≫ Eds-4012 Firmware Version <= 3.2
   Moxa ≫ Eds-4012 Version-
Moxa ≫ Eds-4014 Firmware Version <= 3.2
   Moxa ≫ Eds-4014 Version-
Moxa ≫ Eds-g4008 Firmware Version <= 3.2
   Moxa ≫ Eds-g4008 Version-
Moxa ≫ Eds-g4012 Firmware Version <= 3.2
   Moxa ≫ Eds-g4012 Version-
Moxa ≫ Eds-g4014 Firmware Version <= 3.2
   Moxa ≫ Eds-g4014 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.476
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
psirt@moxa.com 6.5 2.3 3.7
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.