Vendor
Moxa
137 known vulnerabilities.
Products
39 results · Clear filters · Feed
-
Medium 5.3
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device ser…
-
Medium 6.9
Missing Authorization on Secret Endpoints
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive info…
-
Medium 6.9
Improper Authorization of Break Signal Commands in Devices
A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal comm…
-
Medium 6.9
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPo…
-
Medium 6.0
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownersh…
-
Medium 6.3
Unauthenticated Device Registration Vulnerability in MXsecurity Series
An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by …
-
Medium 4.8
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative atta…
-
Medium 5.3
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and ro…
-
Medium 5.2
Stored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 Series
A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrati…
-
Medium 5.3
MXsecurity Use of Hard-coded Credentials
MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data.
-
Medium 5.3
MXsecurity License Generation Function Disclosure
The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource.
-
Medium 5.3
MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to …
-
Medium 6.5
MXview One Series vulnerable to Path Traversal
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT si…
-
Medium 5.5
MXview One and MXview One Central Manager Series store cleartext credentials in a local file
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.
-
Medium 6.3
OnCell G3470A-LTE Series: Authenticated Format String Errors
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and …
-
Medium 6.5
EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the so…
-
Medium 5.3
OnCell G3150A-LTE Series: Web Server Transmits Cleartext Credentials
A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser…
-
Medium 5.3
OnCell G3150A-LTE Series: Clickjacking Vulnerability
A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting …
-
Medium 6.5
ioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability
A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get…
-
Medium 6.5
Web Server Buffer Overflow Vulnerability
A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to t…
-
Medium 6.5
NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability
All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the…
-
Medium 5.3
MXsecurity Register Database Pollution
A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices…
-
Medium 5.3
ioLogik 4000 Series: Server Banner Information Disclosure
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather …
-
Medium 4.3
ioLogik 4000 Series: Session Headers Not Implemented
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading t…
-
Medium 5.3
ioLogik 4000 Series: Existence of an Unauthorized Service
A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data thef…
-
Medium 5.4
NPort IAW5000A-I/O Series Hardcoded Credential Vulnerability
NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and integrity of the affected device. This vulnerability is attributed to the presence of a hardcoded key…
-
Medium 5.3
TN-5900 Series User Enumeration Vulnerability
TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force atta…
-
Medium 5.9
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial E…
-
Medium 5.3CVE-2022-40224 EPSS 65%
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Sw…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 5.3
An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial …
-
Medium 5.3
An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Networ…
-
Medium 5.3
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.
-
Medium 5.3
An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless…
-
Medium 5.3
An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Serie…
-
Medium 5.3
An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A w…
-
Medium 5.9
An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP runn…