CVE-2022-40691

2023-02-0717:15:10

CWE-200

[email protected]

web.nvd.nist.gov

information disclosure

web application

http request

sensitive information

attack

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

71.2%

JSON

An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.

Affected configurations

Nvd

Node

moxasds-3008Match-

AND

moxasds-3008_firmwareRange≤2.1

Node

moxasds-3008-tMatch-

AND

moxasds-3008-t_firmwareRange≤2.1

VendorProductVersionCPE
moxasds-3008-cpe:2.3:h:moxa:sds-3008:-:*:*:*:*:*:*:*
moxasds-3008_firmware*cpe:2.3:o:moxa:sds-3008_firmware:*:*:*:*:*:*:*:*
moxasds-3008-t-cpe:2.3:h:moxa:sds-3008-t:-:*:*:*:*:*:*:*
moxasds-3008-t_firmware*cpe:2.3:o:moxa:sds-3008-t_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moxa	sds-3008	-	cpe:2.3:h:moxa:sds-3008:-:::::::*
moxa	sds-3008_firmware	*	cpe:2.3:o:moxa:sds-3008_firmware::::::::
moxa	sds-3008-t	-	cpe:2.3:h:moxa:sds-3008-t:-:::::::*
moxa	sds-3008-t_firmware	*	cpe:2.3:o:moxa:sds-3008-t_firmware::::::::