CVE-2021-32974: Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input Validation
Published Apr 1, 2022
·Updated
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.
Affected Software
9 affected components
MOXA NPort IAW5000A-I/O Series firmware Version 2.2 or earlier
MOXA Nport Iaw5150a-6i\/o Firmware<=2.2
MOXA Nport Iaw5150a-6i\/o
MOXA Nport Iaw5150a-12i\/o Firmware<=2.2
MOXA Nport Iaw5150a-12i\/o
MOXA Nport Iaw5250a-6i\/o Firmware<=2.2
MOXA Nport Iaw5250a-6i\/o
MOXA Nport Iaw5250a-12i\/o Firmware<=2.2
MOXA Nport Iaw5250a-12i\/o
Remediation
Information
Moxa has developed solutions to address these vulnerabilities. Please contact Moxa Technical Support for a security patch.
Moxa has also published a security advisory to provide more information.
Event History
Apr 1, 2022
CVE Published
via MITRE·10:17 PM
Data Sourced
via MITRE·10:17 PM
RemedyDescriptionSeverityWeakness
Aug 3, 2024
Data Sourced
via ICS·11:42 PM
SeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-32974.
2
What is the severity of CVE-2021-32974?
The severity of CVE-2021-32974 is critical with a CVSS score of 9.8.
3
What is the affected software for CVE-2021-32974?
The affected software for CVE-2021-32974 is Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier.
4
How can a remote attacker exploit CVE-2021-32974?
A remote attacker can exploit CVE-2021-32974 by sending malicious input to the built-in web server, which may allow them to execute commands.
5
Is there a fix or patch available for CVE-2021-32974?
Yes, users should update to a version of the Moxa NPort IAW5000A-I/O series firmware that is later than version 2.2 to mitigate the vulnerability.