Multiple Moxa Ethernet switches are affected by the CVE-2023-48795 and CVE-2019-20372 vulnerabilities. These vulnerabilities pose potential security risks that could impact the integrity and functionality of the affected products. 

The identified vulnerability types and potential impacts are listed below:

Vulnerability Scoring Details 

The Affected Products:

The affected products and firmware versions are listed below.

Solutions:

Moxa has developed appropriate solutions to address vulnerability. The solutions for the affected products are listed below.

Mitigations:

• For the CVE-2023-48795: Disabling vulnerable extensions can prevent the attack vector from being exploited. Additionally, implementing network segmentation can reduce the attack surface and contain potential breaches.

• For the CVE-2019-20372: Proper configuration can prevent exploitation by ensuring error pages are handled securely. Additionally, a Web Application Firewall (WAF) can provide an extra layer of security by filtering out potentially harmful requests before they reach NGINX.

The Products That Are Not Vulnerable:

Only the products listed in the Affected Products section of this advisory are known to be affected by these vulnerabilities. Moxa has confirmed that these vulnerabilities does not affect the following products: 

• EDS-205A Series, EDS-208A Series, EDS-405A Series, EDS-408A Series, EDS-505A Series, EDS-508A Series, EDS-510A Series, EDS-516A Series, EDS-518A Series, EDS-G205A Series, EDS-P206A Series, EDS-P510A Series 
• PT-7528 Series, PT-G503 Series, PT-G510 Series, PT-G7728 Series, PT-G7828 Series 
• End-of-Life Products: PT-7728 Series, PT-7828 Series 

Revision History: