Moxa ioLogik E1200/E2200 Series Firmware Vulnerabilities Advisory (ICSA-16-287-05A)

Critical Vulnerability Information Update Summary Title: Moxa ioLogik E1200 Series Vulnerabilities (Update A) Last Revised Date: January 31, 2017 Alert Code: ICSA-16-287-05A Affected Products Affected Products and Versions: - ioLogik E1210, firmware Version V2.4 and earlier - ioLogik E1211, firmware Version V2.3 and earlier - ioLogik E1212, firmware Version V2.4 and earlier - ioLogik E1213, firmware Version V2.5 and earlier - ioLogik E1214, firmware Version V2.4 and earlier - ioLogik E1240, firmware Version V2.3 and earlier - ioLogik E1241, firmware Version V2.4 and earlier - ioLogik E2210, firmware versions prior to V3.13 - ioLogik E2212, firmware versions prior to V3.14 - ioLogik E2214, firmware versions prior to V3.12 - ioLogik E2240, firmware versions prior to V3.12 - ioLogik E2242, firmware versions prior to V3.12 - ioLogik E2260, firmware versions prior to V3.13 - ioLogik E2262, firmware versions prior to V3.12 Vulnerability Description CWE-79: Cross-site Scripting - CVSS v3 Base Score: 8.8 - Vulnerability Details: The web application fails to properly sanitize user input, allowing script injection and arbitrary code execution. CWE-522: Insufficient Protection of Credentials - CVSS v3 Base Score: 8.1 - Vulnerability Details: Passwords are transmitted in an insecure format. CWE-521: Weak Password Requirements - CVSS v3 Base Score: 8.1 - Vulnerability Details: Users are allowed to use short passwords. CWE-352: Cross-site Request Forgery - CVSS v3 Base Score: 7.3 - Vulnerability Details: The web application fails to adequately verify that requests originate from legitimate users. Exploitability and Mitigation Remotely Exploitable: Yes Public Exploit Information Available: Yes Exploitable by Low-Skill Attackers: Yes Mitigation Measures: - Upgrade to the latest firmware version - Minimize network exposure; ensure devices are not directly connected to the internet - Use secure remote access methods (e.g., VPN) - Follow recommended security practices for control systems

Goal Reached Thanks to every supporter — we hit 100%!

Moxa ioLogik E1200/E2200 Series Firmware Vulnerabilities Advisory (ICSA-16-287-05A)