CVE-2019-6563 EPSS 1.7%
Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.
ICS-CERT · Moxa IKS, EDS
Heading is the official description · CVE.org
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
15.6 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 5/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 5 Mar 2019. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3Initial AccessTA0001
MITRE CTID mapping of the CVE · follow-on activity
Credential AccessTA0006
Brute Force T1110
MITRE CTID mapping of the CVE · how it is exploited
Steal Web Session Cookie T1539
MITRE CTID mapping of the CVE · primary impact
Detection
0 rules for this CVE · 83 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-6563 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Brute ForceT111025 general rules
- External Remote SMB Logon from Public IPhightest
- Hack Tool User Agenthightest
- HackTool - CrackMapExec Executionhightest
- HackTool - Hydra Password Bruteforce Executionhightest
- Password Spray Activityhightest
- Potential MFA Bypass Using Legacy Client Authenticationhightest
- Sign-in Failure Due to Conditional Access Requirements Not Methightest
- Use of Legacy Authentication Protocolshightest
Steal Web Session CookieT15392 general rules
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.