CVE-2022-40693

A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2022-40693

The CVE-2022-40693 entry concerns Moxa SDS-3008 Series Industrial Ethernet Switch (web application) with a cleartext transmission vulnerability. TALOS confirms vulnerable versions are SDS-3008 Series with web management (version 2.1) and provides a login credential exposure via cleartext HTTP, in...

CVE-2022-40693

A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2022-40224

CVE-2022-40224 affects the Moxa SDS-3008 Series Industrial Ethernet Switch (version 2.1) where the web server can be forced to terminate a thread and cause a DoS via a malformed HTTP header. TALOS describes that an HTTP request to port 443 that lacks the required header-body separator (two empty ...

CVE-2022-41311

CVE-2022-41311 is a stored cross-site scripting vulnerability in the web application of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. The issue affects the Switch Location field (webLocationMessage_text) where crafted HTTP input can store malicious JavaScript, executed when other users loa...

CVE-2022-41313

Moxa SDS-3008 Series Industrial Ethernet Switch 2.1 is affected by a stored cross-site scripting (XSS) vulnerability in the web UI. The flaw allows injected JavaScript to be stored via web form fields in the Switch Information section (including the Contact Information field) and executed in othe...

CVE-2022-41312

The CVE-2022-41312 issue affects Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. The web application stores input in the Switch Description field (name switch_description); a specially crafted HTTP request can trigger stored cross-site scripting, resulting in arbitrary JavaScript execution i...

CVE-2022-41311

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-41313

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-40224

A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-41313

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-41312

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-40691

The CVE-2022-40691 issue affects Moxa SDS-3008 Series Industrial Ethernet Switch (web UI, version 2.1). A vulnerability in the web application allows information disclosure via specially crafted HTTP requests, with examples such as accessing /auth/accountpassword.asp/ (and with a trailing backsla...

CVE-2022-40224: Insufficient Resource Pool

A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-40693: Cleartext Transmission of Sensitive Information

A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2022-40691: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-41312: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-41311: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

CVE-2022-41313: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form fiel...

TP-Link SG105PE Authentication Bypass

The vulnerability of TP-Link SG105PE switch’s microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...