2728 matches found
Moxa NPort IA5150A/IA5250A Series Improper Access Control (CVE-2020-27149)
By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with Read Only privilege level can send requests via the web console to have the device's configuration changed. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...
Moxa MB3180 Denial of Service (CVE-2021-33824)
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service. This...
Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input Validation (CVE-2021-32970)
Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service conditions. This plugin only works with Tenable.ot. Please visit...
Moxa AWK-3131A Series Industrial AP/Bridge/Client Improper Neutralization of Special Elements Used in an OS Command (CVE-2019-5142)
An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...
Moxa IKS, EDS Improper Restriction of Excessive Authentication Attempts (CVE-2019-6524)
Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Neutralization of Special Elements Used in an OS Command (CVE-2021-32974)
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa IKS, EDS Plaintext Storage of a Password (CVE-2019-6518)
Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Moxa MB3180 Denial of Service (CVE-2021-33823)
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of- service. This plugin only works with Tenable.ot. Please visit...
Moxa PT-7528 and PT-7828 Series Use of Hard-Coded Credentials (CVE-2020-6985)
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10702)
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter iwfilename is susceptible to...
Moxa AWK-3121 Cleartext Transmission of Sensitive Information (CVE-2018-10694)
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between t...
Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10697)
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST paramet...
Moxa EDR-810 Unauthenticated Remote Code Execution with Root Privileges (CVE-2018-16282)
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI. This plugin only works with Tenable.ot. Please visit...
Moxa ioLogik E2200 Series Insufficiently Protected Credentials (CVE-2016-2282)
Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt credentials, which makes it easier for remote attackers to obtain the associated cleartext via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
MOXA NPort 5110 Out-of-Bounds Write (CVE-2022-2043)
MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of- bounds write that can cause the device to become unresponsive. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
MOXA NPort 5110 Out-of-Bounds Write (CVE-2022-2044)
MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of- bounds write that may allow an attacker to overwrite values in memory, causing a denial-of-service condition or potentially bricking the device. This plugin only works with Tenable.ot. Please visit...
Moxa MB3xxx Series Protocol Gateways Cross-Site Request Forgery (CVE-2019-9102)
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery CSRF protection...
Moxa EDR-810 Web Server URI Denial of Service (CVE-2017-12124)
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability. This...
Moxa EDR-G903 Secure Router Plaintext Storage of a Password (CVE-2016-0876)
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Moxa AWK-3131A Series Industrial AP/Bridge/Client Use of Hard-Coded Credentials (CVE-2019-5139)
An exploitable use of hard-coded credentials vulnerability exists in multiple iw utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. This plugin only works with...