Skip to content
OpenAdvisories
Critical ICSA-20-287-01 6 CVEs

MOXA NPort IAW5000A-I/O Series

Published Oct 13, 2020 · Updated Oct 13, 2020

Vendor: Moxa Product: NPort

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain access to and hijack a session; allow an attacker with user privileges to perform requests with administrative privileges; allow the use of weak passwords; allow credentials of third-party services to be transmitted in cleartext; allow the use of brute force to bypass authentication on an SSH/Telnet session; or allow access to sensitive information without proper authorization.

Vulnerabilities 6

  • Critical 9.8
    CVE-2020-25153

    MOXA NPort IAW5000A-I/O Series

    The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.

    Moxa NPort IAW5000A-I/O ICS / OT
  • Critical 9.8
    CVE-2020-25196

    MOXA NPort IAW5000A-I/O Series

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication.

    Moxa NPort IAW5000A-I/O ICS / OT
  • High 8.8
    CVE-2020-25194

    MOXA NPort IAW5000A-I/O Series

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.

    Moxa NPort IAW5000A-I/O ICS / OT
  • High 8.8
    CVE-2020-25198

    MOXA NPort IAW5000A-I/O Series

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.

    Moxa NPort IAW5000A-I/O ICS / OT
  • High 7.5
    CVE-2020-25190

    MOXA NPort IAW5000A-I/O Series

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.

    Moxa NPort IAW5000A-I/O ICS / OT
  • Medium 5.3
    CVE-2020-25192

    MOXA NPort IAW5000A-I/O Series

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.

    Moxa NPort IAW5000A-I/O ICS / OT

Revision history

  1. #1

    ICSA-20-287-01 MOXA NPort IAW5000A-I/O Series

References