Login Request a demo
High severity · published Apr 6, 2018
CVE-2018-7506
The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt…
7.5
CVSS
1.9%
EPSS
No
On KEV
Description
The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MX
Mxview · Moxa
through 2.8 · source: NVD
Affected product
MX
Mxview
Moxa
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7506
Third Party Advisory
http://www.securityfocus.com/bid/103722
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-095-02
More from Mxview
10.0
CVE-2021-38454
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute…
9.8
CVE-2021-40390
An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4
9.8
CVE-2021-38458
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute…
9.8
CVE-2021-38456
A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accounts using default…
9.1
CVE-2021-38452
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute…