CVE-2019-6522

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-65239.8WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.CVE-2019-65249.8Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to disCVE-2019-65258.8AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and iCVE-2019-65269.8Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A seCVE-2019-65279.8PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the passworCVE-2019-65288.8PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4CVE-2019-65294.9An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software VerCVE-2019-65307.8Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-basedCVE-2019-65318.1An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or SoftwCVE-2019-65327.8Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompaCVE-2019-65339.1Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway vCVE-2019-65347.8The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 en
CVE-2019-6522: Critical severity, CVSS 9.1 | Vulnix