CVE-2021-32976

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Moxa	NPort IAW5000A-I/O series firmware	>= unspecified, <= 2.2

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01Mitigation, Third Party Advisory, US Government Resource
https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilitiesVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-187-01Mitigation, Third Party Advisory, US Government Resource
https://www.moxa.com/en/support/product-support/security-advisory/nport-iaw5000a-io-serial-device-server-vulnerabilitiesVendor Advisory

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-329777.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.CVE-2021-329787.5The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered passwo CVE-2021-329797.5Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a CVE-2021-32985.4Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manage CVE-2021-329809.8Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming co CVE-2021-329817.2AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or d CVE-2021-329827.5Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and projec CVE-2021-329839.8A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and p CVE-2021-329849.8All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Dir CVE-2021-329857.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.CVE-2021-329869.8After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state CVE-2021-329877.5Null pointer dereference in SuiteLink server while processing command 0x0b