CVE-2019-18238

HIGH

Moxa ioLogik 2500 Series Firmware < 3.0 - Cleartext Storage of Sensitive Information

Title source: llm
STIX 2.1

Description

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration files without encryption, which may allow an attacker to access an administrative account.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-056-02

Scores

CVSS v3 7.5
EPSS 0.0014
EPSS Percentile 34.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-312
Status published
Products (20)
moxa/iologik_2512-hspa-t_firmware < 3.0
moxa/iologik_2512-hspa_firmware < 3.0
moxa/iologik_2512-t_firmware < 3.0
moxa/iologik_2512-wl1-eu-t_firmware < 3.0
moxa/iologik_2512-wl1-eu_firmware < 3.0
moxa/iologik_2512-wl1-jp-t_firmware < 3.0
moxa/iologik_2512-wl1-jp_firmware < 3.0
moxa/iologik_2512-wl1-us-t_firmware < 3.0
moxa/iologik_2512-wl1-us_firmware < 3.0
moxa/iologik_2512_firmware < 3.0
... and 10 more
Published Feb 26, 2020
Tracked Since Feb 18, 2026