dbcve.org
Nport Iaw5000a I\/o FirmwareOperating system · Moxa

CVE-2020-25190

CRITICAL · 9.8 CVSS v3.1 Published 2020-12-23
Fix available
A fix is available. Upgrade to after 2.1 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

The built-in web server in MOXA NPort IAW5000A-I/O devices (firmware 2.1 and below) stores and transmits third-party service credentials in cleartext, allowing unauthenticated attackers to intercept or obtain sensitive authentication credentials via network sniffing or access to stored data.

MitigationUpgrade firmware to version higher than 2.1 when available; until then, implement network segmentation, restrict web server access to trusted networks, and monitor for unauthorized access attempts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Nport Iaw5000a I\/o FirmwareOperating system
Affected:<= 2.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm device model
    Access the device web interface or use SNMP/serial console to identify the exact model number. Verify it is an NPort IAW5000A-I/O series device.
    Affected if Device is not a Moxa NPort IAW5000A-I/O series unit
  2. Check firmware version
    Log into the device web interface and navigate to System Settings or use the device's CLI command to display firmware version. Compare against version 2.1.
    Affected if Firmware version is 2.1 or lower
  3. Verify web server is enabled
    In the device web interface, go to Network Settings or Communication Settings and confirm whether the built-in web server HTTP/HTTPS service is currently enabled.
    Affected if Web server is enabled and accessible on the network
  4. Identify stored third-party credentials
    In the web interface, navigate to any sections that configure third-party service integrations (such as cloud services, email servers, or authentication servers). Look for fields where usernames and passwords are stored.
    Affected if Third-party service credentials are configured and stored on the device
  5. Inspect network traffic for cleartext transmission
    Use a network packet capture tool on the same network segment as the device. Capture traffic when the device communicates with third-party services or when credentials are submitted through the web interface. Analyze if credentials are transmitted in cleartext (unencrypted).
    Affected if Network capture shows credentials transmitted in cleartext without TLS/SSL encryption

If the device is a Moxa NPort IAW5000A-I/O with firmware 2.1 or below, and the built-in web server is enabled with third-party credentials configured, the device is affected by this vulnerability.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 2.1
Interim mitigation

Upgrade firmware to version higher than 2.1 when available; until then, implement network segmentation, restrict web server access to trusted networks, and monitor for unauthorized access attempts.

Recommended fix Moderate confidence

Firmware version higher than 2.1 (contact MOXA for exact fixed release)

  1. Identify the current firmware version of the MOXA NPort IAW5000A-I/O device by accessing the web interface or using the device management tool
  2. Download the latest firmware version from the official MOXA support website (moxa.com) or contact MOXA technical support
  3. Review the firmware upgrade instructions in the product manual or release notes
  4. Back up the current device configuration before performing the upgrade
  5. Access the device administration interface and navigate to the firmware update section
  6. Upload and install the new firmware file
  7. After upgrade, verify the device is functioning correctly and confirm the new firmware version
  8. Change all credentials that may have been transmitted in cleartext, as they may have been compromised
Caveat Review release notes for any configuration or feature changes that may affect existing setup

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Nport Iaw5000a I\/o Firmware Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA1.0 h
10.0 hours of engineering $1,750
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-25190 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-25190 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data