Frontend Authorization Logic Disclosure Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Moxa | EDS-508A Series | 1.0 – 3.11 | — | No fix listed | CNA |
| Moxa | PT-508 Series | 1.0 – 3.8 | — | No fix listed | CNA |
| Moxa | PT-510 Series | 1.0 – 3.8 | — | No fix listed | CNA |
| Moxa | PT-7528 Series | 1.0 – 5.0 | — | No fix listed | CNA |
| Moxa | PT-7728 Series | 1.0 – 3.9 | — | No fix listed | CNA |
| Moxa | PT-7828 Series | 1.0 – 4.0 | — | No fix listed | CNA |
| Moxa | PT-G503 Series | 1.0 – 5.3 | — | No fix listed | CNA |
| Moxa | PT-G510 Series | 1.0 – 6.5 | — | No fix listed | CNA |
| Moxa | PT-G7728 Series | 1.0 – 6.5 | — | No fix listed | CNA |
| Moxa | PT-G7828 Series | 1.0 – 6.5 | — | No fix listed | CNA |
- EDS-508A Series VendorMoxa Affected 1.0 – 3.11 Fixed in — No fix listed CNA
- PT-508 Series VendorMoxa Affected 1.0 – 3.8 Fixed in — No fix listed CNA
- PT-510 Series VendorMoxa Affected 1.0 – 3.8 Fixed in — No fix listed CNA
- PT-7528 Series VendorMoxa Affected 1.0 – 5.0 Fixed in — No fix listed CNA
- PT-7728 Series VendorMoxa Affected 1.0 – 3.9 Fixed in — No fix listed CNA
- PT-7828 Series VendorMoxa Affected 1.0 – 4.0 Fixed in — No fix listed CNA
- PT-G503 Series VendorMoxa Affected 1.0 – 5.3 Fixed in — No fix listed CNA
- PT-G510 Series VendorMoxa Affected 1.0 – 6.5 Fixed in — No fix listed CNA
- PT-G7728 Series VendorMoxa Affected 1.0 – 6.5 Fixed in — No fix listed CNA
- PT-G7828 Series VendorMoxa Affected 1.0 – 6.5 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12297
- 2026-10-03 Alias added: GHSA-jp78-8mxr-44qr
References
Advisory 2
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series
- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches
More Moxa vulnerabilities
- TI-2021-17455 Hard-coded credentials in Moxa MXView Series CVSS 3.1CRITICAL 9.8
- TI-2010-04465 Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5… CVSS 2.0HIGH 10.0
- TI-2022-19087 A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008… CVSS 3.1HIGH 7.5
- TI-2016-07634 Missing brute-force protection in Moxa NPort CVSS 3.1CRITICAL 9.8
- TI-2021-17457 Cleartext transmission of sensitive information in Moxa MXView Series CVSS 3.1HIGH 7.5
- TI-2022-19326 Information disclosure in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-12297 · CVE Program
- CVE-2024-12297 · NVD
- FIRST EPSS
- GHSA-jp78-8mxr-44qr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences