Moxa vulnerabilities
324 vulnerabilities
Known vulnerabilities in Moxa products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 644 products.
Products
50 of 644- Awk 3131A28 vulnerabilities
- Edr 81021 vulnerabilities
- EDR G9010 Series17 vulnerabilities
- TN 4900 Series16 vulnerabilities
- NAT 102 Series15 vulnerabilities
- Awk 312114 vulnerabilities
- EDR 8010 Series13 vulnerabilities
- Eds 405A13 vulnerabilities
- Eds 408A13 vulnerabilities
- Mxview13 vulnerabilities
- AWK 3131A Series Industrial IEEE 802.11A/B/G/N Wireless Ap/Bridge/Client11 vulnerabilities
- EDF G1002 BP Series11 vulnerabilities
- Nport 5100A Series11 vulnerabilities
- Oncell G4302 LTE4 Series11 vulnerabilities
- Tn 590011 vulnerabilities
- Edr G90310 vulnerabilities
- Eds 510A10 vulnerabilities
- Iks G6824A10 vulnerabilities
- Mxsecurity Series10 vulnerabilities
- Nport 5100 Series10 vulnerabilities
- Nport 5200 Series10 vulnerabilities
- Nport 5200A Series10 vulnerabilities
- Nport 5400 Series10 vulnerabilities
- Nport 5600 Series10 vulnerabilities
- Mb31709 vulnerabilities
- Mb31809 vulnerabilities
- Mb32709 vulnerabilities
- Mb32809 vulnerabilities
- Mb34809 vulnerabilities
- Mb36609 vulnerabilities
- Mxsecurity9 vulnerabilities
- Nport P5150A Series9 vulnerabilities
- Oncell G3150 Hspa9 vulnerabilities
- Oncell G3150 Hspa T9 vulnerabilities
- TN 5900 Series9 vulnerabilities
- EDR 810 Series8 vulnerabilities
- Nport 5600 8 Dtl Series8 vulnerabilities
- Nport 5X50A1 M12 Series8 vulnerabilities
- Nport 6100 Series8 vulnerabilities
- Nport Iaw5000A I\/O8 vulnerabilities
- Oncell G3470A Lte Eu8 vulnerabilities
- Oncell G3470A Lte Eu T8 vulnerabilities
- Eds G512E7 vulnerabilities
- Eds G516E7 vulnerabilities
- Softcms7 vulnerabilities
- Thingspro7 vulnerabilities
- Thingspro Iiot Gateway And Device Management Software Solutions7 vulnerabilities
- EDR G9004 Series6 vulnerabilities
- EDR G902 Series6 vulnerabilities
- EDR G903 Series6 vulnerabilities
CVE-2026-109813moxaaig-302 series
EPSS score0.15%
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.CVE-2026-109812moxaaig-302 seriesEPSS score0.13%
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.CVE-2018-16282moxaedr-810_firmwareEPSS score5.25%
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.CVE-2018-19660moxanport_w2x50a_firmwareEPSS score28.80%
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.CVE-2018-19659moxanport_w2x50a_firmwareEPSS score4.10%
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/net_WebPingGetValue can result in running OS commands as the root user. This is similar to CVE-2017-12120.CVE-2018-11421moxaoncell_g3150-hspa_firmware+1EPSS score0.91%
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to remote unauthenticated disclosure of sensitive information, including the administrator's password. Under certain conditions, it's also possible to retrieve additional information, such as content of HTTP requests to the device, or the previously used password, due to memory leakages.CVE-2018-11420moxaoncell_g3150-hspa_firmware+1EPSS score1.54%
There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-11423.CVE-2018-11425moxaoncell_g3470a-lte-eu_firmware+3EPSS score1.54%
Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-11424.CVE-2018-11424moxaoncell_g3470a-lte-eu_firmware+3EPSS score1.36%
There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-11425.CVE-2018-11427moxaoncell_g3150-hspa_firmware+1EPSS score0.58%
CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF attacks on the device administrator.CVE-2018-11426moxaoncell_g3150-hspa_firmware+1EPSS score1.84%
A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change.CVE-2018-11423moxaoncell_g3150-hspa_firmware+1EPSS score1.36%
There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420.CVE-2018-11422moxaoncell_g3150-hspa_firmware+1EPSS score1.02%
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication.CVE-2018-7506ics-certmoxa mxview+1EPSS score1.91%
The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information.CVE-2018-18390moxathingspro+1EPSS score1.12%
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18394moxathingspro+1EPSS score0.71%
Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18396moxathingspro+1EPSS score2.34%
Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18391moxathingspro+1EPSS score1.02%
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18393moxathingspro+1EPSS score1.01%
Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18395moxathingspro+1EPSS score1.54%
Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.