CVE-2020-25198 MOXA NPort IAW5000A-I/O Series

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies...

CVE-2020-25194

CVE-2020-25194 affects MOXA NPort IAW5000A-I/O Series, firmware 2.1 or lower. The vulnerability is due to improper privilege management in the built‑in WEB server, potentially allowing a user‑level attacker to perform requests with administrative privileges. CVSSv3.1/ATT&CK context indicates high...

CVE-2020-25194 MOXA NPort IAW5000A-I/O Series

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges...

CVE-2020-25190 MOXA NPort IAW5000A-I/O Series

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext...

CVE-2020-25190

The CVE-2020-25190 issue affects MOXA NPort IAW5000A-I/O Series, where the built-in WEB server in firmware v2.1 or lower stores and transmits third‑party service credentials in cleartext. This creates an exposure risk for credentials transmitted over the network, with CVSSv3.1 base score 9.8 (NET...

The vulnerability of the asynchronous Moxa NPort 5100A server, related to security mechanisms’ deficiencies, allows attackers to escalate their privileges.

The vulnerability of the asynchronous Moxa NPort 5100A server is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

MOXA NPort IAW5000A-I/O Series

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: MOXA Equipment: NPort IAW5000A-I/O Series Vulnerabilities: Session Fixation, Improper Privilege Management, Weak Password Requirements, Cleartext Transmission of Sensitive Information, Improper...

The vulnerability of the NPort IAW5000A-I/O Series web server software lies in its lack of access control mechanisms, allowing attackers to send arbitrary requests to the vulnerable system.

The vulnerability of the NPort IAW5000A-I/O Series web server software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to send arbitrary requests to the vulnerable system remotely...

The vulnerability of the SSH/Telnet protocol implementations in NPort IAW5000A-I/O Series web server software allows a hacker to bypass security restrictions.

The vulnerability of the SSH/Telnet protocol implementations in NPort IAW5000A-I/O Series web servers is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions remotely...

The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers allows attackers to disclose sensitive information.

The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The software vulnerabilities of the NPort IAW5000A-I/O Series web servers, related to session management errors, allow attackers to gain increased privileges.

The vulnerability of the NPort IAW5000A-I/O Series web server software is related to session management errors. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

The vulnerability of the Moxa NPort 5150A asynchronous server allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Moxa NPort 5150A asynchronous server lies in its security flaws. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Moxa NPort 5150A Information Disclosure Vulnerability

Moxa NPort 5150A is an appliance server from Moxa China.An information disclosure vulnerability exists in the Moxa Service 1.5 and prior firmware versions in the Moxa NPort 5150A. A remote attacker could exploit the vulnerability by sending specially crafted packets to the 480 UDP port to obtain...

CVE-2020-12117

Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect...

CVE-2020-12117

Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect...

Design/Logic Flaw

Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect...

CVE-2020-12117

Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect...

CVE-2020-12117

CVE-2020-12117 affects Moxa NPort 5150A devices, specifically firmware 1.5 and earlier. A vulnerability in the unauthenticated Moxa Service allows an attacker to disclose sensitive configuration values by sending a crafted packet to UDP port 4800. The issue is a result of the service running by d...

Moxa NPort W2x50A Operating System Command Injection Vulnerability

Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...

CVE-2018-19659

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/netWebPingGetValue can result in running OS commands as the root user. This is...