PT-2022-5106 · Moxa · Moxa Mxview

Patrick Desantis · Published 2022-02-11 · Updated 2022-10-24 · CVE-2021-40390

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa MXView version 3.2.4

Description The issue is related to the use of hardcoded credentials in the web interface of Moxa MXView, allowing a remote attacker to gain full access to the device by sending a specially crafted HTTP request. This can lead to unauthorized access.

Recommendations For Moxa MXView version 3.2.4, consider disabling the web interface functionality until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of unauthorized access. Avoid using the web application functionality in Moxa MXView until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-06352

CVE-2021-40390

Affected Products

Moxa Mxview

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1401 · Exploit
• https://osv.dev/vulnerability/CVE-2021-40390 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06352 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40390 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mxview-network-management-software-vulnerabilities-(1) · Note