SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-242013863] Moxa PT-7728 Series Switch Improper Authorization Vulnerability

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2016-06-16OTHERMoxa PT-7728 SeriesCan DemirelN/A2016-4514N/AN/AN/A

Source

						
							
								
#
# Moxa PT-7728 Series Switch Improper Authorization Vulnerability
#


### OVERVIEW

Independent researcher Can Demirel has identified an improper authorization vulnerability in Moxa's Industrial Ethernet Switch PT-7728 series. Moxa has produced an update to mitigate this vulnerability. Can Demirel has tested the update to validate that it resolves the vulnerability.

This vulnerability could be exploited remotely.




### AFFECTED PRODUCTS

The following Moxa Industrial Ethernet Switches are affected:

PT-7728 Series Version 3.4 build 15081113






### IMPACT

Successful exploitation of this vulnerability may allow an attacker to access management functions. Attackers can update switch configuration.

Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.





### BACKGROUND

Moxa is a Taiwan-based company that maintains offices in several countries around the world, including the US, UK, India, Germany, France, China, Russia, and Brazil.

The affected products, PT-7728 series, are managed Ethernet switches designed especially for industrial applications. According to Moxa, PT-7728 series switches are deployed across several sectors, including Chemical, Commercial Facilities, Critical Manufacturing, Emergency Services, Energy, Food and Agriculture, Government Facilities, Water and Wastewater Systems, and others. Moxa estimates that these products are used globally but concentrated in the US, Europe, Chile, Argentina, Peru, Columbia, and Taiwan, with 50 to 60 percent of all sales in the US.





### VULNERABILITY CHARACTERIZATION


# VULNERABILITY OVERVIEW

IMPROPER AUTHORIZATION

The switch series support least privilege account with given credentials. The default user account has limited access to switch functions. Using local proxy to interrupt traffic, the switch configuration can be updated. It means least privilege account can access and modify critical switch configuration.
CVE-2016-4514 has been assigned to this vulnerability. A CVSS v3 base score of 7.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).






### VULNERABILITY DETAILS


# EXPLOITABILITY

This vulnerability could be exploited remotely.


# EXISTENCE OF EXPLOIT

No known public exploits specifically target this vulnerability.


# DIFFICULTY

Crafting a working exploit for this vulnerability would be difficult. Local proxy must be used to interrupt traffic and update switch configuration.




### MITIGATION

Moxa has produced an update to mitigate this vulnerability. The update is available upon request.