CVE-2021-38458: Moxa MXview Network Management Software
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moxa MXview Network Management Softwareto a version that resolves this vulnerability.Fixed in 3.2.4 - Compensating control
Use a firewall to allow only the MXview Accessible IP from the client site (if users do not need the multiple-site function).
- Compensating control
If using a multiple-site function, use a firewall to block Port 8883.
- Operational
Change the Windows password regularly.
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-38458.
What is the title of this vulnerability?
The title of this vulnerability is 'A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2'.
What is the description of this vulnerability?
The description of this vulnerability is a path traversal vulnerability in the Moxa MXview Network Management software that may allow an attacker to create or overwrite critical files used to execute code.
What is the affected software and version range for this vulnerability?
The affected software for this vulnerability is Moxa MXview Network Management software Versions 3.x to 3.2.2.
What is the severity of this vulnerability?
The severity of this vulnerability is critical with a CVSS score of 9.8.
Is there any official reference for this vulnerability?
Yes, there is an official reference for this vulnerability. You can find it at [here](https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03).
What are the Common Weakness Enumeration (CWE) IDs associated with this vulnerability?
The CWE IDs associated with this vulnerability are CWE-22 and CWE-74.