MOXA NPort IAW5000A-I/O Series
The built-in WEB server has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user 's cookies.CVE-2020-25198 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The built-in WEB server has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.CVE-2020-25194 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The built-in web service does not require users to have strong passwords.CVE-2020-25153 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The built-in web server stores and transmits the credentials of third-party services in cleartext.CVE-2020-25190 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The built-in web server allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication.CVE-2020-25196 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The built-in web service allows sensitive information to be displayed without proper authorization.CVE-2020-25192 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).