TN-5900 Series User Enumeration Vulnerability

Vulnerability

The TN-5900 Series web login page contains a user enumeration vulnerability in the password recovery feature. Affected firmware versions are 3.3 and earlier. The issue is classified as CWE-204 (Observable Response Discrepancy), where the server returns different responses for valid and invalid usernames, allowing an attacker to determine which accounts exist [1].

Exploitation

An attacker with network access to the device's web interface can send password recovery requests for various usernames. By observing the response differences (e.g., error messages or timing), the attacker can compile a list of valid usernames without authentication. This enumeration step then enables targeted brute-force password attacks against the identified accounts [1].

Impact

Successful exploitation results in the disclosure of valid usernames, which is sensitive information. This information can be leveraged to perform brute-force attacks, potentially leading to unauthorized access to the device. The impact is primarily information disclosure and an increased risk of account compromise [1].

Mitigation

Moxa has developed solutions for the affected TN-5900 Series devices. Users should contact Moxa support or refer to the security advisory (MPSA-230401) for firmware update details. No specific fixed version is listed in the advisory. The TN-4900 Series and other products listed in the advisory are not affected [1].