Kaspersky Lab publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky Lab does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
| KL-IDS | KLCERT-18-018 |
| CVE-IDS | CVE-2018-18390 |
| Publication date | 2018.10.18 |
| Researcher | Alexander Nochvay, Kaspersky Lab ICS CERT |
| Description | User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software. |
| Impact | A remote attacker can find valid users in web applications and use brute force to exploit this vulnerability to find the corresponding password. |
| Severity | |
| CVSS v3 Base Score: | 7.5 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Exploitability | Remotely |
| Difficulty | Low |
| User interaction | None |
| Existence of exploit | Unknown |
| Affected products | |
| Affected products | Moxa ThingsPro v. 2.1 |
| Mitigation | |
| Vendor mitigation | Use stronger password, for example:
Moxa has addressed these vulnerabilities with a new firmware release for ThingsPro Gateway Edition 2.3, please contact your sales representative to get the firmware. |
| Timeline | Jan 2018 – Vulnerabilities reported Oct 2018 – Vendor releases patch Oct 2018 – Advisory published |