CVE-2017-7455 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Moxa	Mxview	2.8

Related Weaknesses (CWE)

CWE-200

References

http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DExploitThird Party Advisory
http://packetstormsecurity.com/files/142074/Moxa-MXview-2.8-Private-Key-DisclosuExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2017/Apr/49ExploitMailing ListThird Party Advisory
https://www.exploit-db.com/exploits/41850/
http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DExploitThird Party Advisory
http://packetstormsecurity.com/files/142074/Moxa-MXview-2.8-Private-Key-DisclosuExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2017/Apr/49ExploitMailing ListThird Party Advisory
https://www.exploit-db.com/exploits/41850/

FAQ

What is CVE-2017-7455?

CVE-2017-7455 is a vulnerability with a CVSS score of 7.5 (HIGH). Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.

How severe is CVE-2017-7455?

CVE-2017-7455 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-7455?

Check the references section above for vendor advisories and patch information. Affected products include: Moxa Mxview.