Unprotected storage of credentials in Moxa products - CVE-2020-27150
Published: April 28, 2021 / Updated: May 12, 2021
Vulnerability identifier: #VU52688
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27150
CWE-ID: CWE-256
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to other users' credentials.
The vulnerability exists due to unprotected storage of credentials. A remote attacker can extract authentication credentials from a configuration file sent over an insecure communication channel and change the device’s configurations.
Affected software
NPort IA5150A Series
NPort IA5250A Series
NPort IA5450A Series
NPort IA5250A Series
NPort IA5450A Series
How to mitigate CVE-2020-27150
Install updates from vendor's website.
NPort IA5150A Series - update to 1.5
NPort IA5250A Series - update to 1.5
NPort IA5450A Series - update to 2.0
NPort IA5250A Series - update to 1.5
NPort IA5450A Series - update to 2.0