CVE-2020-24052

Several XML External Entity XXE vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition DTD in an XML request...

CVE-2020-24053

Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols...

EUVD-2020-16787

Malware in sbrugna...

EUVD-2020-16789

Malware in sbrugna...

EUVD-2020-16790

Malware in sbrugna...

CVE-2020-24051

The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issu...

Hardcoded credentials

Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols...

Authentication flaw

The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issu...

CVE-2020-24054

The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments;...

CVE-2020-24053

Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols...

CVE-2020-24052

Several XML External Entity XXE vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition DTD in an XML request...

CVE-2020-24053: Use of Hard-coded Credentials

Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols...

PT-2020-15630

Name of the Vulnerable Software and Affected Versions Moog EXO Series EXVF5C-2 and EXVP7C2-3 units affected versions not specified Description The issue concerns a hardcoded credentials vulnerability, which could lead to confidentiality issues when using the FTP, Telnet, or SSH protocols...

CVE-2020-24051: Missing Authentication for Critical Function

The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issu...

CVE-2020-24054: Improper Neutralization of Special Elements used in an OS Command

The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments;...

PT-2020-15631

Name of the Vulnerable Software and Affected Versions Moog EXO Series versions affected versions not specified Description The administration console of the Moog EXO Series units has a feature that allows spawning a process repeatedly at a certain time interval as 'root'. This feature can be...

PT-2020-15629

Name of the Vulnerable Software and Affected Versions Moog EXO Series versions EXVF5C-2 and EXVP7C2-3 Description The issue concerns several XML External Entity XXE vulnerabilities. These vulnerabilities allow remote unauthenticated users to read arbitrary files by using a crafted Document Type...

CVE-2020-24052: Improper Restriction of XML External Entity Reference

Several XML External Entity XXE vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition DTD in an XML request...

PT-2020-15628

Name of the Vulnerable Software and Affected Versions Moog EXO Series versions EXVF5C-2 and EXVP7C2-3 Description A security issue was found in the Moog EXO Series units that support the ONVIF interoperability protocol. The authentication check for certain ONVIF operations can be bypassed, allowi...