TI-2020-16500 Aliases CVE-2020-27149 GHSA-6q59-xh2r-73jw

By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user…

LOW 30Published 2021-05-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed.

Why it matters now

EPSS 0.00691 53rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	NPort IA5000A Series with web console enabled	All versions before 1.5 for NPort IA5150A/IA5250A Series. All version before 2.0 for NPort 5450 Series	—	No fix listed	CNA

NPort IA5000A Series with web console enabled Vendor— Affected All versions before 1.5 for NPort IA5150A/IA5250A Series. All version before 2.0 for NPort 5450 Series Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:moxa:nport_ia5150a_firmware::::::::	before 1.5	Vulnerable	Moxa
cpe:2.3:h:moxa:nport_ia5150a:-:::::::*	not specified by NVD	Running on	Moxa
cpe:2.3:o:moxa:nport_ia5250a_firmware::::::::	before 1.5	Vulnerable	Moxa
cpe:2.3:h:moxa:nport_ia5250a:-:::::::*	not specified by NVD	Running on	Moxa
cpe:2.3:o:moxa:nport_ia5450a_firmware::::::::	before 2.0	Vulnerable	Moxa
cpe:2.3:h:moxa:nport_ia5450a:-:::::::*	not specified by NVD	Running on	Moxa

cpe:2.3:o:moxa:nport_ia5150a_firmware:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·Moxa
cpe:2.3:h:moxa:nport_ia5150a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa
cpe:2.3:o:moxa:nport_ia5250a_firmware:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·Moxa
cpe:2.3:h:moxa:nport_ia5250a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa
cpe:2.3:o:moxa:nport_ia5450a_firmware:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·Moxa
cpe:2.3:h:moxa:nport_ia5450a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-27149
2026-10-03 Alias added: GHSA-6q59-xh2r-73jw

References

Advisory 1

https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities

Other 1

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-018%2C

TI-2023-04539 NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability CVSS 3.1HIGH 8.8
TI-2020-16501 In multiple versions of NPort IA5000A Series, the result of exporting a device’s… CVSS 3.1HIGH 7.5
TI-2020-16526 Cleartext transmission of sensitive information in NPort IA5000A Series with Moxa Service… CVSS 3.1HIGH 7.5
TI-2020-16525 Cleartext transmission of sensitive information in NPort IA5000A Series with Telnet… CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences