CVE-2022-40691: medium-severity vulnerability in Moxa SDS-3008 Series Industrial Ethernet Switch
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Moxa SDS-3008 Series switch exposes sensitive information through specially-crafted HTTP requests. An attacker can retrieve this data without proper authentication or authorization.
An information disclosure vulnerability in the web application of Moxa SDS-3008 Series (v2.1) allows an unauthenticated attacker to craft specific HTTP requests that bypass access controls and leak sensitive information. The vulnerability requires network access to the web interface but no credentials, potentially exposing configuration, credentials, or operational data.
In the same product, most dangerous first.