Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 1 of 7
Oct 27, 2026A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers.CVE-2026-111548 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational.
- Product
- NPort W2150A-W4/W2250A-W4 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An OS command injection vulnerability exists in OnCell G3150A-LTE Series.CVE-2026-111461 · Other software · Moxa · reported by psirt@moxa.comHigh 7.5
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series.CVE-2026-111460 · Other software · Moxa · reported by psirt@moxa.comHigh 7.7
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client).CVE-2026-111459 · Other software · Moxa · reported by psirt@moxa.comHigh 7.6
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.
- Product
- Moxa Remote Connect Suite (MRC Client)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products.CVE-2026-109813 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
- Product
- AIG-302 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products.CVE-2026-109812 · Other software · Moxa · reported by psirt@moxa.comMedium 6.9
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
- Product
- AIG-302 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authCVE-2026-86326 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.
- Product
- MGate MB3170 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.CVE-2026-86325 · Other software · Moxa · reported by psirt@moxa.comCritical 9.4
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.
- Product
- MGate MB3170 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login procesCVE-2026-15579 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the authentication process to crash and result in a Denial of Service (DoS) attack.
- Product
- TN-4500B Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port.CVE-2026-10831 · Other software · Moxa · reported by psirt@moxa.comMedium 6.9
A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal commands. A remote attacker with network access can send crafted requests to disrupt serial communication for an active user session.
- Product
- NPort 6000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier.CVE-2026-10829 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic settings page. An attacker could exploit this vulnerability by sending crafted input to the web service, resulting in memory corruption. Successful exploitation of this vulnerability could allow remote code execution on the target system with root privileges.
- Product
- NPort W2150A-W4/W2250A-W4 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5CVE-2026-10828 · Other software · Moxa · reported by psirt@moxa.comMedium 6.9
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.
- Product
- NPort W2150A-W4/W2250A-W4 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests.CVE-2026-10825 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
- Product
- NPort 6000-G2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers.CVE-2026-9266 · Other software · Moxa · reported by psirt@moxa.comHigh 7
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
- Product
- UC-1200A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.CVE-2026-3868 · Other software · Moxa · reported by psirt@moxa.comHigh 8.7
An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attacker could send specially crafted requests that trigger a buffer overflow condition, causing the web service to become unresponsive. Successful exploitation may result in a denial-of-service condition requiring a device reboot to restore normal operation. While successful exploitation can severely impact the availability of the affected device, no impact to the confidentiality or integrity of the affected product has been identified. Additionally, no confidentiality, integrity, or availability impact to the subsequent system has been identified.
- Product
- EDR-8010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An improper ownership management vulnerability has been identified in Moxa’s Secure Router.CVE-2026-3867 · Other software · Moxa · reported by psirt@moxa.comMedium 6
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.
- Product
- EDR-8010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers.CVE-2026-4483 · Other software · Moxa · reported by psirt@moxa.comHigh 7
An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory. A local attacker with high privileges could abuse these interfaces to perform unauthorized operations. Successful exploitation may result in privilege escalation on Windows 7 systems or cause a system crash (BSoD) on Windows 10 and 11 systems, leading to a denial-of-service condition. The vulnerability could slightly affect the confidentiality and integrity of the device, but availability might be heavily impacted. No impact to the subsequent system has been identified.
- Product
- MxGeneralIo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device.CVE-2026-0715 · Other software · Moxa · reported by psirt@moxa.comHigh 7
Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.
- Product
- UC-1200A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the disCVE-2026-0714 · Other software · Moxa · reported by psirt@moxa.comHigh 7
A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical access, including opening the device and attaching external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of eMMC contents. This attack cannot be performed through brief or opportunistic physical access and requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible.
- Product
- UC-1200A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection throCVE-2025-2026 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and result in a denial-of-service (DoS) condition. An authenticated remote attacker with web read-only privileges can exploit the vulnerable API to inject malicious input. Successful exploitation may cause the device to reboot, disrupting normal operations and causing a temporary denial of service.
- Product
- NPort 6100-G2/6200-G2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with reCVE-2025-1977 · Other software · Moxa · reported by psirt@moxa.comHigh 7.7
The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC (Moxa CLI Configuration) tool. The issue can be exploited remotely over the network with low-attack complexity and no user interaction but requires specific system conditions or configurations to be present. Successful exploitation may result in changes to device settings that were not intended to be permitted for the affected user role, potentially leading to a high impact on the confidentiality, integrity, and availability of the device. No impact on other systems has been identified.
- Product
- NPort 6100-G2/6200-G2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface.CVE-2025-15017 · Other software · Moxa · reported by psirt@moxa.comHigh 7
A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access to internal debug functionality. Exploitation is low complexity and allows an attacker to execute privileged operations and access sensitive system resources, resulting in a high impact to the confidentiality, integrity, and availability of the affected device. No security impact to external or dependent systems has been identified.
- Product
- NPort 5000AI-M12 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identifCVE-2025-9315 · Other software · Moxa · reported by psirt@moxa.comMedium 6.3
An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON payload to the device's registration endpoint /api/v1/devices/register, allowing the attacker to register unauthorized devices without authentication. Although exploiting this vulnerability has limited modification of data, there is no impact to the confidentiality and availability of the affected device, as well as no loss of confidentiality, integrity, and availability within any subsequent systems.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administCVE-2025-1680 · Other software · Moxa · reported by psirt@moxa.comNone
An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems.
- Product
- TN-4500A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an afCVE-2025-1679 · Other software · Moxa · reported by psirt@moxa.comMedium 4.8
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is classified as stored cross-site scripting (XSS); attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of availability within any subsequent systems but has some loss of confidentiality and integrity within the subsequent system.
- Product
- TN-4500A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6950 · Other software · Moxa · reported by psirt@moxa.comCritical 9.9
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6949 · Other software · Moxa · reported by psirt@moxa.comCritical 9.3
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6894 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative `ping` function, which is restricted to higher-privileged roles. This vulnerability enables the user to perform internal network reconnaissance, potentially discovering internal hosts or services that would otherwise be inaccessible. Repeated exploitation could lead to minor resource consumption. While the overall impact is limited, it may result in some loss of confidentiality and availability on the affected device. There is no impact on the integrity of the device, and the vulnerability does not affect any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6893 · Other software · Moxa · reported by psirt@moxa.comCritical 9.3
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw allows a low-privileged authenticated user to call the API without the required permissions, thereby gaining the ability to access or modify system configuration data. Successful exploitation may lead to privilege escalation, allowing the attacker to access or modify sensitive system settings. While the overall impact is high, there is no loss of confidentiality or integrity within any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6892 · Other software · Moxa · reported by psirt@moxa.comHigh 8.7
An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative functions. This vulnerability can be exploited after a legitimate user has logged in, as the system fails to properly validate session context or privilege boundaries. An attacker may leverage this flaw to perform unauthorized privileged operations. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025In the Linux kernel, the following vulnerability has been resolved: mmc: moxart: fix return value check of mmc_add_host() mmc_add_host() may return error, if CVE-2022-50268 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mmc: moxart: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 25, 2025An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows).CVE-2025-5191 · Other software · Moxa · reported by psirt@moxa.comHigh 7.3
An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in the SerialInterfaceService.exe utility, a local attacker with limited privileges could place a malicious executable in a higher-priority directory within the search path. When the Serial Interface service starts, the malicious executable could be run with SYSTEM privileges. Successful exploitation could allow privilege escalation or enable an attacker to maintain persistence on the affected system. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality, integrity, or availability within any subsequent systems.
- Product
- Utility for DRP-A100 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input CVE-2025-0676 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to gain root shell access and maintain persistent control over the device, potentially disrupting network services and affecting the availability of downstream systems that rely on its connectivity.
- Product
- EDF-G1002-BP Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings.CVE-2025-0415 · Other software · Moxa · reported by psirt@moxa.comCritical 9.2
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.
- Product
- EDF-G1002-BP Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025Multiple switches are affected by an out-of-bounds write vulnerability.CVE-2024-7695 · Other software · Moxa · reported by psirt@moxa.comHigh 8.7
Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack.
- Product
- PT-7728 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encodCVE-2025-0193 · Other software · Moxa · reported by psirt@moxa.comMedium 5.2
A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability to inject malicious scripts that are continuously stored on the device. These scripts are executed when other users access the login page, potentially resulting in unauthorized actions or other impacts, depending on the user's privileges.
- Product
- MGate 5121 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism.CVE-2024-12297 · Other software · Moxa · reported by psirt@moxa.comCritical 9.2
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
- Product
- EDS-508A Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140.CVE-2024-9140 · Other software · Moxa · reported by psirt@moxa.comCritical 9.3
Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code. This poses a significant risk to the system’s security and functionality.
- Product
- EDR-8010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138.CVE-2024-9138 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk.
- Product
- EDR-810 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024This vulnerability could lead to denial-of-service or service crashes.CVE-2024-9404 · Other software · Moxa · reported by psirt@moxa.comHigh 8.7
This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant remote threat, potentially allowing attackers to shut down affected systems.
- Product
- VPort 07-3 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials.CVE-2024-4740 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable.CVE-2024-4739 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource.
- Product
- MXsecurity Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.CVE-2024-9139 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.
- Product
- EDR-8010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024The affected product lacks an authentication check when sending commands to the server via the Moxa service.CVE-2024-9137 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.
- Product
- EDR-8010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU).CVE-2024-6787 · Other software · Moxa · reported by psirt@moxa.comMedium 6
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to execute malicious code and potentially cause file losses.
- Product
- MXview One Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system.CVE-2024-6786 · Other software · Moxa · reported by psirt@moxa.comMedium 6
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.
- Product
- MXview One Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024The configuration file stores credentials in cleartext.CVE-2024-6785 · Other software · Moxa · reported by psirt@moxa.comMedium 6.8
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.
- Product
- MXview One Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an arCVE-2024-4641 · Other software · Moxa · reported by psirt@moxa.comMedium 6.3
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations.CVE-2024-4640 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration.CVE-2024-4639 · Other software · Moxa · reported by psirt@moxa.comHigh 7.1
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands.
- Product
- OnCell G3150A-LTE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.