Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• moxa eds-405a firmwareup to 3.8 inclusive
• moxa eds-408a firmwareup to 3.8 inclusive
• moxa eds-510a firmwareup to 3.8 inclusive
• moxa iks-g6824a firmwareup to 4.5 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (icscert). Independent of NVD's CPE analysis and usually ahead of it.

• ICS-CERT Moxa IKS, EDS

  • IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prioraffected

Other highest-scoring records for the same primary product.

• CVE-2019-6557Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.
  41Plan
• CVE-2019-6563Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, wh
  40Plan
• CVE-2019-6524Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis
  40Plan
• CVE-2019-6526Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A se
  39Monitor
• CVE-2019-6522Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo
  37Monitor
• CVE-2019-6520Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configu
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.