Vulnerability in Moxa Mxview
CVE-2020-13536
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality.
EPSS: 0.005 (42.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Moxa Mxview — versions 3.1.8
- N/a Moxa — versions Moxa MXView Series 3.1.8
Weakness classification (CWE)
References
- talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-13536?
- CVE-2020-13536 is a high-severity vulnerability in Moxa Mxview, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2020-11-05.
- How severe is CVE-2020-13536?
- High severity. CVSS v3 base score is 7.8 out of 10.