Moxa: Security Vulnerabilities
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/net_WebPingGetValue can result in running OS commands as the root user. This is similar to CVE-2017-12120.
CVSS Score
8.8
EPSS Score
0.005
Published
2018-12-06
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.
CVSS Score
8.8
EPSS Score
0.022
Published
2018-12-06
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-10-19
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
8.8
EPSS Score
0.004
Published
2018-10-19
Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
8.8
EPSS Score
0.004
Published
2018-10-19
Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-10-19
Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
9.8
EPSS Score
0.002
Published
2018-10-19
Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
9.8
EPSS Score
0.004
Published
2018-10-19
Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS Score
9.8
EPSS Score
0.02
Published
2018-10-19
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVSS Score
8.8
EPSS Score
0.042
Published
2018-09-20