Moxa
Page 3 of 4 — Moxa CVEs from a corpus of 320, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6522 | Critical | 9.1 | 2019-03-05 | Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to re… |
CVE-2019-6520 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. |
CVE-2019-6518 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. |
CVE-2018-19660 | High | 8.8 | 2018-12-06 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil… |
CVE-2018-19659 | High | 8.8 | 2018-12-06 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil… |
CVE-2018-18396 | Critical | 9.8 | 2018-10-19 | Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18395 | Critical | 9.8 | 2018-10-19 | Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18394 | Critical | 9.8 | 2018-10-19 | Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18393 | Critical | 9.8 | 2018-10-19 | Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18392 | High | 8.8 | 2018-10-19 | Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18391 | High | 8.8 | 2018-10-19 | User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-18390 | High | 7.5 | 2018-10-19 | User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. |
CVE-2018-16282 | High | 8.8 | 2018-09-20 | A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands… |
CVE-2018-10632 | High | 7.5 | 2018-07-24 | In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not restricted, allowing f… |
CVE-2017-14439 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14438 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14437 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14436 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14435 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14434 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-14433 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-14432 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-12129 | High | 8.0 | 2018-05-14 | An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could inte… |
CVE-2017-12128 | High | 7.5 | 2018-05-14 | An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packe… |
CVE-2017-12127 | Medium | 4.4 | 2018-05-14 | A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract… |
CVE-2017-12126 | High | 8.8 | 2018-05-14 | An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP pa… |
CVE-2017-12125 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-12124 | Medium | 6.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-12123 | High | 8.8 | 2018-05-14 | An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An atta… |
CVE-2017-12121 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-12120 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-14459 | Critical | 10.0 | 2018-04-11 | An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wi… |
CVE-2018-7506 | High | 7.5 | 2018-04-06 | The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attac… |
CVE-2016-8717 | Critical | 9.8 | 2018-04-02 | An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system… |
CVE-2018-5455 | Critical | 9.8 | 2018-03-05 | A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The… |
CVE-2018-5453 | High | 7.5 | 2018-03-05 | An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker… |
CVE-2018-5449 | Medium | 6.5 | 2018-03-05 | A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does not check for a NUL… |
CVE-2017-5170 | High | 7.2 | 2018-01-18 | An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path elem… |
CVE-2017-12729 | Critical | 9.8 | 2018-01-18 | A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command ('SQL Injec… |
CVE-2017-14030 | High | 7.8 | 2018-01-12 | An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user with file access to es… |
CVE-2017-16727 | Critical | 9.1 | 2017-12-22 | A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is emp… |
CVE-2017-13701 | Critical | 9.8 | 2017-11-23 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for pa… |
CVE-2017-13699 | High | 7.5 | 2017-11-23 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method… |
CVE-2017-13698 | High | 7.5 | 2017-11-23 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. An attacker could extract public and private keys from the firmware image available on th… |
CVE-2017-13703 | High | 7.5 | 2017-11-17 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur. |
CVE-2017-13702 | Medium | 5.3 | 2017-11-17 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused. |
CVE-2017-13700 | Medium | 4.8 | 2017-11-17 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface. |
CVE-2017-16719 | High | 7.5 | 2017-11-16 | An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3… |
CVE-2017-16715 | High | 8.6 | 2017-11-16 | An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130… |
CVE-2017-14028 | High | 7.5 | 2017-11-16 | A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 V… |
CVE-2017-7917 | High | 8.8 | 2017-05-29 | A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Bu… |
CVE-2017-7915 | Critical | 9.8 | 2017-05-29 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, O… |
CVE-2017-7913 | Critical | 9.8 | 2017-05-29 | A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1… |
CVE-2016-8721 | Critical | 9.1 | 2017-04-20 | An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware… |
CVE-2017-7457 | Medium | 5.0 | 2017-04-14 | XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure. |
CVE-2017-7456 | High | 7.5 | 2017-04-14 | Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials. |
CVE-2017-7455 | High | 7.5 | 2017-04-14 | Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. |
CVE-2016-8727 | High | 7.5 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of… |
CVE-2016-8726 | High | 7.5 | 2017-04-13 | An exploitable null pointer dereference vulnerability exists in the Web Application /forms/web_runScript iw_filename functionality of Moxa AWK-3131A Wireless A… |
CVE-2016-8725 | Medium | 5.3 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1… |
CVE-2016-8724 | Medium | 5.3 | 2017-04-13 | An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A sp… |
CVE-2016-8723 | High | 7.5 | 2017-04-13 | An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET… |
CVE-2016-8722 | Medium | 5.3 | 2017-04-13 | An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless… |
CVE-2016-8720 | Medium | 4.3 | 2017-04-13 | An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1… |
CVE-2016-8712 | High | 8.1 | 2017-04-13 | An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one no… |
CVE-2016-8719 | Medium | 6.1 | 2017-04-12 | An exploitable reflected Cross-Site Scripting vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmwar… |
CVE-2016-8718 | High | 8.8 | 2017-04-12 | An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1… |
CVE-2016-8716 | High | 7.5 | 2017-04-12 | An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running fir… |
CVE-2016-9371 | Medium | 6.1 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9369 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9367 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9366 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9365 | High | 8.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9363 | High | 7.3 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9361 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9356 | High | 7.8 | 2017-02-13 | An issue was discovered in Moxa DACenter Versions 1.4 and older. The application may suffer from an unquoted search path issue. |
CVE-2016-9354 | Medium | 5.5 | 2017-02-13 | An issue was discovered in Moxa DACenter Versions 1.4 and older. A specially crafted project file may cause the program to crash because of Uncontrolled Resour… |
CVE-2016-9348 | Low | 3.3 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9346 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a… |
CVE-2016-9344 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute fo… |
CVE-2016-9333 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacke… |
CVE-2016-9332 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexp… |
CVE-2016-8379 | High | 8.1 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-8372 | High | 8.1 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-8363 | Critical | 10.0 | 2017-02-13 | An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2… |
CVE-2016-8362 | Medium | 6.5 | 2017-02-13 | An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2… |
CVE-2016-8360 | High | 8.1 | 2017-02-13 | An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double fre… |
CVE-2016-8359 | Medium | 6.1 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-8350 | Medium | 6.3 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-8346 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is… |
CVE-2016-5793 | High | 8.8 | 2016-09-24 | Unquoted Windows search path vulnerability in Moxa Active OPC Server before 2.4.19 allows local users to gain privileges via a Trojan horse executable file in… |
CVE-2016-5812 | Low | 3.3 | 2016-08-24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local us… |
CVE-2016-5799 | Critical | 9.8 | 2016-08-24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it e… |
CVE-2016-5792 | Critical | 9.8 | 2016-08-08 | SQL injection vulnerability in Moxa SoftCMS before 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields. |
CVE-2016-5804 | Critical | 9.8 | 2016-07-15 | Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which… |
CVE-2016-4503 | Critical | 9.8 | 2016-07-12 | Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to readi… |
CVE-2016-4514 | High | 7.7 | 2016-06-19 | Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy. |
CVE-2016-4500 | Medium | 5.8 | 2016-06-01 | Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access. |
CVE-2016-2295 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-2286 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |