// For flags

CVE-2024-1220

NPort W2150A/W2250A Series Web Server Stack-based Buffer Overflow Vulnerability

Severity Score

8.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulnerability could result in denial of service.

Un desbordamiento de búfer en la región stack de la memoria en el servidor web integrado en la versión 2.3 y anteriores del firmware de la serie Moxa NPort W2150A/W2250A permite a un atacante remoto explotar la vulnerabilidad enviando un payload manipulado al servicio web. La explotación exitosa de la vulnerabilidad podría resultar en la denegación del servicio.

*Credits: Vladimir Razov from Positive Technologies
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-05 CVE Reserved
  • 2024-03-06 CVE Published
  • 2024-03-06 EPSS Updated
  • 2024-08-23 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-121: Stack-based Buffer Overflow
CAPEC
  • CAPEC-8: Buffer Overflow in an API Call
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Moxa
Search vendor "Moxa"
 NPort W2150A/W2250A Series
Search vendor "Moxa" for product "NPort W2150A/W2250A Series"
 >= 1.0 <= 2.3
Search vendor "Moxa" for product "NPort W2150A/W2250A Series" and version " >= 1.0 <= 2.3"
en
Affected