Skip to content
OpenAdvisories
Medium ICSA-24-268-05 3 CVEs

Moxa MXview One

Published Sep 24, 2024 · Updated Sep 24, 2024

Vendor: Moxa Product: MXview One Central Manager Series Product: MXview One Series

Summary

Successful exploitation of these vulnerabilities could allow an attacker to expose local credentials and write arbitrary files to the system, resulting in execution of malicious code.

Vulnerabilities 3

  • Medium 6.5
    CVE-2024-6786

    MXview One Series vulnerable to Path Traversal

    The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT si…

    Moxa MXview One Series ICS / OT
  • Medium 5.5
    CVE-2024-6785

    MXview One and MXview One Central Manager Series store cleartext credentials in a local file

    The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.

    Moxa MXview One Series MXview One Central Manager Series ICS / OT
  • Medium 5.3
    CVE-2024-6787

    MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition

    This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to …

    Moxa MXview One Series ICS / OT

Revision history

  1. #1

    Initial Publication

References