CVE-2024-12297

CVE-2024-12297 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-656.

Key facts

Description

Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

Frequently asked questions

What is CVE-2024-12297?
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
How severe is CVE-2024-12297?
CVE-2024-12297 has a CVSS 4.0 base score of 9.2, rated critical severity.
Is CVE-2024-12297 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-12297?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-12297 have an EU (EUVD) identifier?
Yes. CVE-2024-12297 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-50752.
When was CVE-2024-12297 published?
CVE-2024-12297 was published on 2025-01-15 and last updated on 2026-06-17.

References

Other CWE-656 vulnerabilities

Browse all CWE-656 vulnerabilities →