Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
| Link | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 | third party advisory us government resource |
| http://www.securityfocus.com/bid/107178 | vdb entry third party advisory |