Full Report
Cleartext Transmission of Sensitive Information via Moxa Service in NPort IA5000A series serial devices.
Analysis Summary
# Vulnerability: Cleartext Transmission of Sensitive Information in Moxa NPort IA5000A
## CVE Details
- **CVE ID:** CVE-2020-27185
- **CVSS Score:** 6.8 (Medium)
- **CVSS Vector:** [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N]
- **CWE:** CWE-319 (Cleartext Transmission of Sensitive Information)
## Affected Systems
- **Products:** Moxa NPort IA5000A Series (including Standard, -T, -IEX, and -AI models)
- **Versions:** All versions prior to the release of the vendor advisory (April 2021).
- **Configurations:** Devices with the "Moxa Service" enabled and reachable via the network. Specific models include:
- NPort IA5150A / IA5150AI (and -T, -IEX variants)
- NPort IA5250A / IA5250AI (and -T, -IEX variants)
- NPort IA5450A / IA5450AI (and -T variants)
## Vulnerability Description
The Moxa Service, used for device discovery and configuration management, transmits sensitive data in cleartext. Because the communication protocol lacks encryption, an attacker positioned to intercept network traffic can capture authentication credentials, device configuration parameters, and other sensitive operational data.
## Exploitation
- **Status:** Unknown (No publicly documented exploits in the wild at time of report).
- **Complexity:** High (Requires the attacker to perform a Man-in-the-Middle [MitM] attack).
- **Attack Vector:** Network (Targeting 4800/UDP or 4900/TCP).
- **Requirement:** User interaction is required; a legitimate user must trigger the Moxa Service using utilities like DSU (Device Search Utility) or NPort Search Utility while the attacker is monitoring the traffic.
## Impact
- **Confidentiality:** High (Exposure of administrative credentials and device configurations).
- **Integrity:** None (The vulnerability itself is read-only, though captured data could lead to future integrity breaches).
- **Availability:** None.
## Remediation
### Patches
- Users are advised to check the Moxa support portal for the latest firmware updates for the IA5000A series that address security vulnerabilities.
### Workarounds
- **Disable Moxa Service:** If the search/configuration utility is not required for daily operations, disable the "Moxa Service" via the device console settings.
- **Access Control:** Restrict access to ports **4800/UDP** and **4900/TCP** using a firewall, allowing only authorized workstations to communicate with these ports.
- **Encryption:** Use a VPN to tunnel traffic when accessing the device over untrusted or remote networks to prevent sniffing.
## Detection
- **Indicators of Compromise:** Presence of unauthorized Man-in-the-Middle tools (e.g., ARP spoofing) on the local industrial network.
- **Detection Methods:**
- Use a Network Intrusion Detection System (NIDS) to identify unencrypted sensitive data patterns on ports 4800/UDP and 4900/TCP.
- Monitor for abnormal network traffic or unauthorized connection attempts to management ports.
## References
- **Vendor Advisory:** hxxps://www[.]moxa[.]com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities
- **NVD Detail:** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2020-27185
- **Researcher Advisory:** hxxps://ics-cert[.]kaspersky[.]com/advisories/2021/05/11/klcert-20-021/