CVE-2021-40390 Auth bypass in MXView Series

What is CVE-2021-40390?

CVE-2021-40390 is a critical authentication bypass vulnerability in Moxa MXView Series, published on 14 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability.

Weakness: CWE-798

Which versions are affected by CVE-2021-40390?

It affects 1 product.

Products include Moxa Mxview.

How do I fix CVE-2021-40390?

No fix has been published for CVE-2021-40390 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-40390 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-40390 exists.

Other vulnerabilities in Moxa MXView Series

• CVE-2021-38454 Moxa MXview Network Management Software Critical 10.0
• CVE-2021-38456 Moxa MXview Network Management Software Critical 9.8
• CVE-2021-38458 Moxa MXview Network Management Software Critical 9.8
• CVE-2020-13536 Privilege escalation in Moxa Critical 9.3
• CVE-2020-13537 Privilege escalation in Moxa Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wgcx-pj93-24xq.