Vulnerability · Published Nov 5, 2020 · Assigned by talos

CVE-2020-13537

Critical 9.3

In plain English

A critical-severity incorrect default permissions in Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.0)9.3Critical

Exploit odds (30 days)0.5%top 54.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run.

Affected products (as reported)

Vendor	Product	Versions
n/a	Moxa	Moxa MXView Series 3.1.8

Weakness: CWE-276 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1148 x_refsource_MISC