CVE-2018-18395: vulnerability in Moxa ThingsPro IIoT Gateway and Device…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A security flaw in Moxa ThingsPro version 2.1 allows attackers to access hidden authentication tokens that should be protected. This could let someone bypass security controls and gain unauthorized access to the system.
CVE-2018-18395 involves improper protection of authentication tokens in Moxa ThingsPro IIoT Gateway 2.1, enabling attackers with local or network access to retrieve hidden tokens and potentially escalate privileges or bypass authentication mechanisms. The vulnerability stems from insufficient token obfuscation or encryption, allowing direct token extraction from the software.
In the same product, most dangerous first.