CVE-2022-40691

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Moxa	SDS-3008 Series Industrial Ethernet Switch	2.1
moxa	sds-3008_firmware	<= 2.1
moxa	sds-3008-t_firmware	<= 2.1

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1621Exploit, Third Party Advisory
https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilitiesVendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1621Exploit, Third Party Advisory
https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilitiesVendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1621

Timeline

Published: Feb 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406928.8Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.CVE-2022-406937.5A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A CVE-2022-406944.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.CVE-2022-406958.8Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.CVE-2022-406967.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanc CVE-2022-406974.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.CVE-2022-406986.1Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-406996.1Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.CVE-2022-40709.8Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-407009.8Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership CVE-2022-407018.1A directory traversal vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially CVE-2022-407024.3Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: