16 March 2020
KLCERT-20-002: XXE on Moxa’s cellular management software OnCell Central Manager Version lower than 2.4.1
Vendor
Moxa
-
CVE-IDS
-
KLCERT
KLCERT-20-002
Timeline
Timeline
-
Kaspersky ICS CERT advisory published
16 March 2020
-
Vendor releases patch
March 2020
-
Vulnerabilities reported
November 2019
Description
Exploitability
Remotely
Attack complexity
User interaction
Impact
Existence of exploit
Unknown
Affected products
OnCell Central Manager Version lower than 2.4.1
Mitigation
Vendor mitigation
The library that uses OnCell Central Manager has been migrated to Apache’s latest release version 4.7.3 which has fixed these vulnerabilities.
Please contact Moxa Technical Support for the security patch.
Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
