Kaspersky Lab publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky Lab does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
| KL-IDS | KLCERT-18-021 |
| CVE-IDS | CVE-2018-18393 |
| Publication date | 2018.10.18 |
| Researcher | Alexander Nochvay, Kaspersky Lab ICS CERT |
| Description | Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software. |
| Impact | A remote attacker is able to change the user’s password. |
| Severity | |
| CVSS v3 Base Score: | 9.3 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N |
| Exploitability | Remotely |
| Difficulty | Low |
| User interaction | None |
| Existence of exploit | Unknown |
| Affected products | |
| Affected products | Moxa ThingsPro v. 2.1 |
| Mitigation | |
| Vendor mitigation | Moxa has addressed these vulnerabilities with a new firmware release for ThingsPro Gateway Edition 2.3, please contact your sales representative to get the firmware. |
| Timeline | Jan 2018 – Vulnerabilities reported Oct 2018 – Vendor releases patch Oct 2018 – Advisory published |