A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008…
Priority HIGH 75CWE-410Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.64686 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Moxa | SDS-3008 Series Industrial Ethernet Switch | 2.1 | — | No fix listed | CNA |
- SDS-3008 Series Industrial Ethernet Switch VendorMoxa Affected 2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:moxa:sds-3008_firmware:*:*:*:*:*:*:*:* | up to 2.1 | Vulnerable | Moxa |
| cpe:2.3:h:moxa:sds-3008:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Moxa |
| cpe:2.3:o:moxa:sds-3008-t_firmware:*:*:*:*:*:*:*:* | up to 2.1 | Vulnerable | Moxa |
| cpe:2.3:h:moxa:sds-3008-t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Moxa |
- cpe:2.3:o:moxa:sds-3008_firmware:*:*:*:*:*:*:*:* Versions up to 2.1 Vulnerable ·Moxa
- cpe:2.3:h:moxa:sds-3008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa
- cpe:2.3:o:moxa:sds-3008-t_firmware:*:*:*:*:*:*:*:* Versions up to 2.1 Vulnerable ·Moxa
- cpe:2.3:h:moxa:sds-3008-t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Moxa
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40224
- 2026-10-03 Alias added: GHSA-96vh-xrjg-62gv
References
More Moxa Sds-3008-t Firmware vulnerabilities
- TI-2022-19326 Information disclosure in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.3
- TI-2022-19810 Cross-site scripting in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.4
- TI-2022-19809 Cross-site scripting in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.4
- TI-2022-19808 Cross-site scripting in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.4
- TI-2022-19328 Cleartext transmission of sensitive information in Moxa SDS-3008 Series Industrial… CVSS 3.1HIGH 7.5
Sources
- CVE-2022-40224 · CVE Program
- CVE-2022-40224 · NVD
- FIRST EPSS
- GHSA-96vh-xrjg-62gv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences