CVE-2019-6561

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
ICS-CERT	Moxa IKS, EDS	IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior

References

http://www.securityfocus.com/bid/107178Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/107178Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01Third Party Advisory, US Government Resource

Timeline

Published: Mar 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65625.4In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed CVE-2019-65639.8Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, wh CVE-2019-65647.8GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file director CVE-2019-65656.1Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attack CVE-2019-65667.8GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which CVE-2019-65675.5A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT s CVE-2019-65687.5The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a deni CVE-2019-65699.1The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.CVE-2019-65708.8A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions,CVE-2019-65717.5A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS CVE-2019-65729.1A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Pane CVE-2019-65747.5A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions