What’s Vulnerable › Vulnerabilities
CVE-2024-12297: Frontend Authorization Logic Disclosure Vulnerability
- Severity: critical (CVSS 9.2 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-01-15 · updated 2026-06-17
- Weakness: CWE-656
Description
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
Affected products
- Moxa EDS-508A Series: from 1.0 through 3.11
- Moxa PT-G503 Series: from 1.0 through 5.3
- Moxa PT-508 Series: from 1.0 through 3.8
- Moxa PT-510 Series: from 1.0 through 3.8
- Moxa PT-7528 Series: from 1.0 through 5.0
- Moxa PT-7728 Series: from 1.0 through 3.9
- Moxa PT-7828 Series: from 1.0 through 4.0
- Moxa PT-G510 Series: from 1.0 through 6.5
- Moxa PT-G7728 Series: from 1.0 through 6.5
- Moxa PT-G7828 Series: from 1.0 through 6.5
References
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches
Get alerted when CVE-2024-12297 or the next vulnerability affects your stack