Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 2 of 7
Jun 25, 2024OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload functioCVE-2024-4638 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands.
- Product
- OnCell G3470A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability.CVE-2024-3576 · Other software · Moxa · reported by psirt@moxa.comHigh 8.3
The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerability to get sensitive information and escalate privileges.
- Product
- NPort 5100A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit tCVE-2024-1220 · Other software · Moxa · reported by psirt@moxa.comHigh 8.2
A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulnerability could result in denial of service.
- Product
- NPort W2150A/W2250A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate.CVE-2024-0387 · Other software · Moxa · reported by psirt@moxa.comMedium 6.5
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests.
- Product
- EDS-4008 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host struCVE-2022-48626 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base register of the device and using it instead of the pointer dereference.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 31, 2023A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior.CVE-2023-6094 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive information. This type of attack could be executed to gather sensitive information or to facilitate a subsequent attack against the target.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2023A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior.CVE-2023-6093 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting with. This vulnerability may lead the attacker to trick the user into interacting with the application.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2023A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior.CVE-2023-5962 · Other software · Moxa · reported by psirt@moxa.comMedium 6.5
A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.
- Product
- ioLogik E1200 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2023A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior.CVE-2023-5961 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.
- Product
- ioLogik E1200 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is notCVE-2023-5035 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- PT-G503 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicatioCVE-2023-4217 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- PT-G503 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable.CVE-2023-5627 · Other software · Moxa · reported by psirt@moxa.comHigh 7.5
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service.
- Product
- NPort 6000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability.CVE-2023-4452 · Other software · Moxa · reported by psirt@moxa.comMedium 6.5
A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to trigger the device reboot.
- Product
- EDR-810 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability.CVE-2023-4929 · Other software · Moxa · reported by psirt@moxa.comMedium 6.5
All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.
- Product
- NPort 5000AI-M12 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2023A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to vCVE-2023-39983 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2023A vulnerability has been identified in MXsecurity versions prior to v1.0.1.CVE-2023-39982 · Other software · Moxa · reported by psirt@moxa.comHigh 7.5
A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate man-in-the-middle attacks and enable the decryption of SSH traffic.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2023A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1.CVE-2023-39981 · Other software · Moxa · reported by psirt@moxa.comHigh 7.5
A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2023A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1.CVE-2023-39980 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2023There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication.CVE-2023-39979 · Other software · Moxa · reported by psirt@moxa.comCritical 9.8
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collectioCVE-2023-4230 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.
- Product
- ioLogik 4000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks.CVE-2023-4229 · Other software · Moxa · reported by psirt@moxa.comMedium 4.3
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures.
- Product
- ioLogik 4000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set propCVE-2023-4228 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- ioLogik 4000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to pCVE-2023-4227 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of sensitive information. The vulnerability is attributed to the presence of an unauthorized service, which could potentially enable unauthorized access to the. device.
- Product
- ioLogik 4000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability.CVE-2023-34217 · Other software · Moxa · reported by psirt@moxa.comHigh 8.1
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability.CVE-2023-34216 · Other software · Moxa · reported by psirt@moxa.comHigh 8.1
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability.CVE-2023-34215 · Other software · Moxa · reported by psirt@moxa.comHigh 7.2
TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which could potentially allow malicious users to execute remote code on affected devices.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability.CVE-2023-34214 · Other software · Moxa · reported by psirt@moxa.comHigh 7.2
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious users to execute remote code on affected devices.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability.CVE-2023-34213 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability.CVE-2023-33239 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability.CVE-2023-33238 · Other software · Moxa · reported by psirt@moxa.comHigh 7.2
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability.CVE-2023-33237 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted actions that only high-privileged APIs are allowed This presents a potential risk of unauthorized exploitation by malicious actors.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and inCVE-2023-4204 · Other software · Moxa · reported by psirt@moxa.comMedium 5.4
NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and integrity of the affected device. This vulnerability is attributed to the presence of a hardcoded key, which could potentially facilitate firmware manipulation.
- Product
- NPort IAW5000A-I/O Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability.CVE-2023-3336 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users.
- Product
- TN-5900 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability.CVE-2023-33236 · Other software · Moxa · reported by psirt@moxa.comCritical 9.8
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023MXsecurity version 1.0 is vulnearble to command injection vulnerability.CVE-2023-33235 · Other software · Moxa · reported by psirt@moxa.comHigh 7.2
MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted shell and subsequently execute arbitrary code.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Moxa MiiNePort E1 has a vulnerability of insufficient access control.CVE-2023-28697 · Other software · Moxa · reported by twcert@cert.org.twCritical 9.8
Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service.
- Product
- MiiNePort E1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn-cms.azureedge.nettwcert.org.tw
Mar 7, 2023An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS.CVE-2023-1257 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 7.6
An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.
- Product
- UC-8580 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-41313 · Other software · Moxa · reported by talos-cna@cisco.comMedium 5.4
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="switch_contact"
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Feb 7, 2023A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-41312 · Other software · Moxa · reported by talos-cna@cisco.comMedium 5.4
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="Switch Description", name "switch_description"
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Feb 7, 2023A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-41311 · Other software · Moxa · reported by talos-cna@cisco.comMedium 5.4
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="webLocationMessage_text" name="webLocationMessage_text"
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Feb 7, 2023A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-40693 · Other software · Moxa · reported by talos-cna@cisco.comHigh 7.5
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Feb 7, 2023An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-40691 · Other software · Moxa · reported by talos-cna@cisco.comMedium 5.3
An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Feb 7, 2023A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.CVE-2022-40224 · Other software · Moxa · reported by talos-cna@cisco.comHigh 7.5
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- SDS-3008 Series Industrial Ethernet Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.commoxa.com
Nov 28, 2022UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100 SCVE-2022-3088 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.8
UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100 System Image: Versions v1.0 to v1.6, UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.
- Product
- UC-8100A-ME-T System Imaage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that may allow an attacker to overwrite values in memory, causing a denial-of-seCVE-2022-2044 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 8.2
MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that may allow an attacker to overwrite values in memory, causing a denial-of-service condition or potentially bricking the device.
- Product
- MOXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that can cause the device to become unresponsive.CVE-2022-2043 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 7.5
MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that can cause the device to become unresponsive.
- Product
- MOXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device.CVE-2022-27048 · Other software · Moxa · reported by MITREHigh 7.4
A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 or lower. and MGate MB3480 Series Firmware Version 3.2 or lower.
- Product
- Mgate Mb3170i Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4.CVE-2021-40392 · Other software · Moxa · reported by talos-cna@cisco.comHigh 7.5
An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to exploit this vulnerability.
- Product
- MXView Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 14, 2022An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4.CVE-2021-40390 · Other software · Moxa · reported by talos-cna@cisco.comCritical 9.8
An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- MXView Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 1, 2022Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denCVE-2021-32976 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.
- Product
- NPort IAW5000A-I/O series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.