PT-2021-4362 · Moxa · Moxa Mxview

Noam Moshe · Published 2021-10-05 · Updated 2022-02-14 · CVE-2021-38458

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa MXView versions 3.x through 3.2.2

Description The issue is related to a path traversal vulnerability in the Moxa MXView Network Management software. This vulnerability may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries, by sending a specially crafted request. The vulnerability can be exploited remotely.

Recommendations For versions 3.x through 3.2.2, update to a version that fixes the path traversal vulnerability to prevent attackers from creating or overwriting critical files. As a temporary workaround, consider restricting access to critical files and directories to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-04992

CVE-2021-38458

Affected Products

Moxa Mxview

References · 10

• https://bdu.fstec.ru/vul/2021-04992 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38458 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38458 · Vendor Advisory
• https://t.me/cibsecurity/30425 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03 · Note
• https://cybersecurity-help.cz/vdb/SB2021100607 · Note
• https://securitylab.ru/vulnerability/525308.php · Note
• https://t.me/nekaspersky/1799 · Telegram Post
• https://t.me/true_secator/2627 · Telegram Post
• https://moxa.com/en/support/product-support/security-advisory/mxview-network-management-software-vulnerabilities · Note