CVE-2021-40392 Information disclosure in MXView Series

What is CVE-2021-40392?

CVE-2021-40392 is a medium-severity vulnerability in Moxa MXView Series, published on 14 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to exploit this vulnerability.

Weakness: CWE-319

Which versions are affected by CVE-2021-40392?

It affects 1 product.

Products include Moxa Mxview.

How do I fix CVE-2021-40392?

No fix has been published for CVE-2021-40392 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-40392 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-40392 exists.

Other vulnerabilities in Moxa MXView Series

• CVE-2021-40390 Auth bypass in MXView Series Critical 10.0
• CVE-2021-38454 Moxa MXview Network Management Software Critical 10.0
• CVE-2021-38456 Moxa MXview Network Management Software Critical 9.8
• CVE-2021-38458 Moxa MXview Network Management Software Critical 9.8
• CVE-2020-13536 Privilege escalation in Moxa Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w6wg-hmcm-v767.