Moxa vulnerabilities, page 3
324 vulnerabilities
Known vulnerabilities in Moxa products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 644 products.
CVE-2021-40392moxamxview+1
EPSS score0.60%
An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to exploit this vulnerability.CVE-2021-4161moxamgate_mb3180_firmware+5EPSS score0.70%
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.CVE-2021-39279moxaoncell_g3470a-lte-eu_firmware+11EPSS score4.61%
Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.CVE-2021-39278moxaoncell_g3470a-lte-eu_firmware+11EPSS score0.94%
Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.CVE-2021-25849moxavport_06ec-2v26m_firmware+15EPSS score1.05%
An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.CVE-2021-25847moxavport_06ec-2v26m_firmware+15EPSS score1.21%
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.CVE-2021-25845moxavport_06ec-2v26m_firmware+15EPSS score1.02%
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.CVE-2021-25846moxavport_06ec-2v26m_firmware+15EPSS score1.05%
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet.CVE-2021-25848moxavport_06ec-2v26m_firmware+15EPSS score1.21%
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.CVE-2021-46559moxatn-5900_firmwareEPSS score0.44%
The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.CVE-2021-46560moxatn-5900_firmwareEPSS score3.59%
The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.CVE-2021-46082moxamgate_5101-pbm-mn_firmware+5EPSS score1.18%
Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.CVE-2021-38456moxamxview+1EPSS score1.18%
A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accounts using default passwordsCVE-2021-38452moxamxview+1EPSS score1.65%
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.CVE-2021-38454moxamxview+1EPSS score15.79%
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.CVE-2021-38460moxamxview+1EPSS score1.81%
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.CVE-2021-38458moxamxview+1EPSS score1.82%
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.CVE-2021-32968moxanport iaw5000a-i/o series firmware+4EPSS score1.70%
Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service condition.CVE-2021-32974moxanport iaw5000a-i/o series firmware+4EPSS score2.70%
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.CVE-2021-32976moxanport iaw5000a-i/o series firmware+4EPSS score2.79%
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.