Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 3 of 7
Apr 1, 2022Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute coCVE-2021-32974 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.
- Product
- NPort IAW5000A-I/O series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attCVE-2021-32970 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service conditions.
- Product
- NPort IAW5000A-I/O series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-CVE-2021-32968 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service condition.
- Product
- NPort IAW5000A-I/O Series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memCVE-2021-46082 · Other software · Moxa · reported by MITREHigh 7.5
Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.
- Product
- Tn-5916-wv-t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.CVE-2021-46560 · Other software · Moxa · reported by MITRECritical 9.8
The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.
- Product
- Tn-5900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.CVE-2021-46559 · Other software · Moxa · reported by MITREHigh 7.5
The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.
- Product
- Tn-5900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details.CVE-2021-4161 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
- Product
- MGate MB3180 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38460 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38458 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accCVE-2021-38456 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accounts using default passwords
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38454 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 10
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38452 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Sep 7, 2021Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP.CVE-2021-39279 · Other software · Moxa · reported by MITREHigh 8.8
Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
- Product
- Wac-2004 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmoxa.compacketstormsecurity.com
Sep 7, 2021Certain MOXA devices allow reflected XSS via the Config Import menu.CVE-2021-39278 · Other software · Moxa · reported by MITREMedium 6.1
Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
- Product
- Wac-2004 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 18, 2021An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012.CVE-2021-33824 · Other software · Moxa · reported by MITREHigh 7.5
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
- Product
- Mgate Mb3180 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012.CVE-2021-33823 · Other software · Moxa · reported by MITREHigh 7.5
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
- Product
- Mgate Mb3180 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2021Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices.CVE-2020-27185 · Other software · Moxa · reported by vulnerability@kaspersky.comHigh 7.5
Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service.
- Product
- Nport Ia5150a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.commoxa.com
May 14, 2021The NPort IA5000A Series devices use Telnet as one of the network device management services.CVE-2020-27184 · Other software · Moxa · reported by vulnerability@kaspersky.comMedium 5.9
The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks.
- Product
- Nport Ia5150a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.commoxa.com
May 14, 2021In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensiCVE-2020-27150 · Other software · Moxa · reported by vulnerability@kaspersky.comHigh 7.5
In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set.
- Product
- Nport Ia5150a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.commoxa.com
May 14, 2021By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console CVE-2020-27149 · Other software · Moxa · reported by vulnerability@kaspersky.comMedium 6.5
By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed.
- Product
- Nport Ia5150a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.commoxa.com
May 10, 2021An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to DenCVE-2021-25849 · Other software · Moxa · reported by MITREHigh 7.5
An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure CVE-2021-25848 · Other software · Moxa · reported by MITRECritical 9.1
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure CVE-2021-25847 · Other software · Moxa · reported by MITRECritical 9.1
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of serviceCVE-2021-25846 · Other software · Moxa · reported by MITREHigh 7.5
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of serviceCVE-2021-25845 · Other software · Moxa · reported by MITREHigh 7.5
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware VersiCVE-2020-28144 · Other software · Moxa · reported by MITRECritical 9.8
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution.
- Product
- Edr-g903 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2020The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allowCVE-2020-25198 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 8.8
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 23, 2020The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to CVE-2020-25196 · Other software · MOXA · reported by ics-cert@hq.dhs.govCritical 9.8
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 23, 2020The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user priviCVE-2020-25194 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 8.8
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 23, 2020The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.CVE-2020-25192 · Other software · MOXA · reported by ics-cert@hq.dhs.govMedium 5.3
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 23, 2020The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.CVE-2020-25190 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 7.5
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 23, 2020The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.CVE-2020-25153 · Other software · MOXA · reported by ics-cert@hq.dhs.govCritical 9.8
The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
- Product
- NPort IAW5000A-I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 5, 2020An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.CVE-2020-13537 · Other software · Moxa · reported by talos-cna@cisco.comHigh 7.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run.
- Product
- Mxview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 5, 2020An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.CVE-2020-13536 · Other software · Moxa · reported by talos-cna@cisco.comHigh 7.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality.
- Product
- Mxview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 2, 2020A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commCVE-2020-23639 · Other software · Moxa · reported by MITRECritical 9.8
A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa's VPort 461 Series Industrial Video Servers.
- Product
- Vport 461 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series RouteCVE-2020-14511 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series Routers (versions prior to 5.4).
- Product
- Edr-g902-t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
May 1, 2020Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 480CVE-2020-12117 · Other software · Moxa · reported by MITREMedium 5.3
Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect.
- Product
- Nport 5100a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.scadafence.commoxa.com
Mar 26, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer.CVE-2020-6999 · Other software · Moxa · reported by ics-cert@hq.dhs.govMedium 6.5
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer.
- Product
- Mds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service.CVE-2020-7007 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to bCVE-2020-7001 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclosed.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.CVE-2020-6997 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.CVE-2020-6991 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.CVE-2020-6981 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential CVE-2020-6979 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can be recovered.
- Product
- Eds-g516e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements, wCVE-2020-6995 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements, which may allow an attacker to gain unauthorized access.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information fCVE-2020-6993 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information from the web service without authorization.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for accessCVE-2020-6985 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attaCVE-2020-6989 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attackers to cause a denial-of-service condition or execute arbitrary code.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cryptographic algoritCVE-2020-6987 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclosed.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 24, 2020In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic kCVE-2020-6983 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic key, which increases the possibility that confidential data can be recovered.
- Product
- Pt-7528-24tx-hv Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.