203
CVEs
50
Critical
101
High
0
KEV
29
PoC
133
Unpatched C/H
13.3%
Patch Rate
1.8%
Avg EPSS
Severity Breakdown
CRITICAL
50
HIGH
101
MEDIUM
50
LOW
2
Monthly CVE Trend
Affected Products (30)
Awk 3131A Firmware
14
Eds 408A Firmware
13
Eds 405A Firmware
13
Iks G6824A Firmware
10
Mxview
10
Eds 510A Firmware
10
Tn 5900 Firmware
9
Edr G903 Firmware
9
Mxsecurity
9
Nport 5200 Series Firmware
8
Nport 5600 8 Dtl Series Firmware
8
Nport 5100 Series Firmware
8
Nport 5200A Series Firmware
8
Nport Iaw5000A I O Firmware
8
Nport 6100 Series Firmware
8
Nport 5X50A1 M12 Series Firmware
8
Nport 5100A Series Firmware
8
Nport 5400 Series Firmware
8
Nport P5150A Series Firmware
8
Nport 5600 Series Firmware
8
Eds G512E Firmware
7
Thingspro
7
Eds G516E Firmware
7
Pt 7828 R Hv Hv Firmware
6
Pt 7528 16Mst 8Tx 4Gsfp Wv Firmware
6
Pt 7528 16Mst 8Tx 4Gsfp Hv Hv Firmware
6
Pt 7528 8Msc 16Tx 4Gsfp Hv Hv Firmware
6
Pt 7528 20Msc 4Tx 4Gsfp Hv Hv Firmware
6
Pt 7828 R 24 Firmware
6
Pt 7528 20Mst 4Tx 4Gsfp Wv Firmware
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2016-9361 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 49.6%. | CRITICAL | 9.8 | 49.6% | 119 |
PoC
No patch
|
| CVE-2017-7455 | Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 40.0%. | HIGH | 7.5 | 40.0% | 97 |
PoC
No patch
|
| CVE-2016-9332 | An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.7%. | HIGH | 7.5 | 29.7% | 87 |
PoC
No patch
|
| CVE-2017-7456 | Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.5%. | HIGH | 7.5 | 10.5% | 68 |
PoC
No patch
|
| CVE-2016-8721 | An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 1.0% | 67 |
PoC
No patch
|
| CVE-2016-8718 | An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2018-16282 | A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 4.7% | 64 |
PoC
No patch
|
| CVE-2018-19659 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 4.3% | 64 |
PoC
No patch
|
| CVE-2018-19660 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 30.9% | 64 |
PoC
No patch
|
| CVE-2021-39279 | Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 4.6% | 64 |
PoC
No patch
|
| CVE-2016-8712 | An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 0.4% | 61 |
PoC
No patch
|
| CVE-2020-13536 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.5% | 59 |
PoC
No patch
|
| CVE-2020-13537 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.5% | 59 |
PoC
No patch
|
| CVE-2016-8727 | An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.5% | 58 |
PoC
No patch
|
| CVE-2016-8723 | An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.4% | 58 |
PoC
No patch
|