Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attack

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• moxa eds-405a firmwareup to 3.8 inclusive
• moxa eds-408a firmwareup to 3.8 inclusive
• moxa eds-510a firmwareup to 3.8 inclusive
• moxa iks-g6824a firmwareup to 4.5 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (icscert). Independent of NVD's CPE analysis and usually ahead of it.

• ICS-CERT Moxa IKS, EDS

  • IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prioraffected

Other highest-scoring records for the same primary product.

• CVE-2019-6557Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.
  41Plan
• CVE-2019-6563Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, wh
  40Plan
• CVE-2019-6524Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis
  40Plan
• CVE-2019-6526Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A se
  39Monitor
• CVE-2019-6522Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo
  37Monitor
• CVE-2019-6561Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.