CVE-2020-7003 Information disclosure in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower
Attackers can intercept sensitive information transmitted in clear text by Moxa ioLogik devices and configuration utilities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7003?
CVE-2020-7003 is a high-severity vulnerability in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower, published on 24 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is transmitted over some web applications in clear text.
Weakness: CWE-319
Which versions are affected by CVE-2020-7003?
It affects 20 products.
Products include Moxa Iologik 2512-Hspa-T Firmware, Moxa Iologik 2512-Hspa Firmware, Moxa Iologik 2512-T Firmware, Moxa Iologik 2512-Wl1-Eu-T Firmware, Moxa Iologik 2512-Wl1-Eu Firmware, Moxa Iologik 2512-Wl1-Jp-T Firmware and 14 more.
How do I fix CVE-2020-7003?
No fix has been published for CVE-2020-7003 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7003 being exploited?
There is no known exploitation of CVE-2020-7003 in the wild and no public exploit code.
Other vulnerabilities in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower
- CVE-2019-18242 Denial of service in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower
- CVE-2019-18238 Information disclosure in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower
Sources
Also known as GHSA-3xg4-q8gj-25fp.