CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-12126
https://notcve.org/view.php?id=CVE-2017-12126
An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability. Existe una vulnerabilidad de Cross-Site Request Forgery (CSRF) explotable en la funcionalidad de servidor web de Moxa EDR-810 V4.1 build 17030317. Un paquete HTTP especialmente manipulado puede provocar Cross-Site Request Forgery (CSRF). • https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0478 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 1CVE-2017-12129
https://notcve.org/view.php?id=CVE-2017-12129
An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them. Existe una vulnerabilidad de criptografía de contraseñas débil explotable en la funcionalidad de servidor web de Moxa EDR-810 V4.1 build 17030317. Un atacante podría interceptar contraseñas con cifrado débil y realizar ataques de fuerza bruta. • https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0481 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 4.4EPSS: 0%CPEs: 2EXPL: 1CVE-2017-12127
https://notcve.org/view.php?id=CVE-2017-12127
A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device. Existe una vulnerabilidad de almacenamiento de contraseñas en la funcionalidad del sistema operativo de Moxa EDR-810 V4.1 build 17030317. Un atacante con acceso shell podría extraer contraseñas en texto claro desde el dispositivo. • https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0479 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2017-14434
https://notcve.org/view.php?id=CVE-2017-14434
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetmask0= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability. Existe una vulnerabilidad de inyección de comandos explotable en la funcionalidad de servidor web de Moxa EDR-810 V4.1 build 17030317. Una petición POST especialmente manipulada puede provocar un escalado de privilegios, resultando en un shell root. • https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2017-12125
https://notcve.org/view.php?id=CVE-2017-12125
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the "/goform/net_WebCSRGen" uri to trigger this vulnerability. Existe una vulnerabilidad de inyección de comandos explotable en la funcionalidad de servidor web de Moxa EDR-810 V4.1 build 17030317. Una petición POST especialmente manipulada puede provocar un escalado de privilegios, resultando en un shell root. • https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0477 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •