TI-2017-08916 Aliases CVE-2017-12123 GHSA-q73q-mh85-fcv8

Insufficiently protected credentials in Talos Moxa

MEDIUM 40CWE-522Published 2018-05-14 · Updated 2024-09-16

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin.

Why it matters now

EPSS 0.01013 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Talos	Moxa	Moxa EDR-810 V4.1 build 17030317	—	No fix listed	CNA

Moxa VendorTalos Affected Moxa EDR-810 V4.1 build 17030317 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:moxa:edr-810_firmware:4.1:::::::*	4.1	Vulnerable	Moxa
cpe:2.3:h:moxa:edr-810:-:::::::*	not specified by NVD	Running on	Moxa

cpe:2.3:o:moxa:edr-810_firmware:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Moxa
cpe:2.3:h:moxa:edr-810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-12123
2026-10-03 Alias added: GHSA-q73q-mh85-fcv8

References

Exploit 1

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0475

TI-2017-08921 Information disclosure in Talos Moxa CVSS 3.1HIGH 7.5
TI-2018-11662 A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2… CVSS 3.0HIGH 8.8
TI-2017-10541 OS command injection in Talos Moxa CVSS 3.1HIGH 8.8
TI-2017-10540 OS command injection in Talos Moxa CVSS 3.1HIGH 8.8
TI-2017-10539 OS command injection in Talos Moxa CVSS 3.1HIGH 8.8
TI-2017-08918 OS command injection in Talos Moxa CVSS 3.1HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences