CVE-2021-38454: critical vulnerability in Moxa MXview Network Management Software
Moxa MXview Network Management Software
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Moxa MXview Network Management Software allows attackers to create or overwrite critical files on the system by exploiting how the software handles file paths. This can lead to unauthorized code execution and complete system compromise.
Path traversal vulnerability in MXview 3.x–3.2.2 permits an unauthenticated or low-privileged attacker to traverse directory structures and write arbitrary files (programs, libraries) to locations used for code execution. The vulnerability stems from insufficient input validation on file path parameters, enabling arbitrary file creation/overwrite without proper access controls, resulting in remote code execution.
In the same product, most dangerous first.