CVE-2019-10963

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
n/a	Moxa EDR 810	All versions 5.1 and prior

References

http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-274-03Third Party Advisory, US Government Resource
http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-274-03Third Party Advisory, US Government Resource

Timeline

Published: Oct 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109647.1Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose CVE-2019-109658.8In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server in CVE-2019-109665.3In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal CVE-2019-109678.8In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server i CVE-2019-109684.4Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enab CVE-2019-109697.2Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the CVE-2019-10975.5An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio CVE-2019-109709.8In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or la CVE-2019-109717.8The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that CVE-2019-109725.5Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with CVE-2019-109737.2Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the CVE-2019-109745.5NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten wi