CVE-2024-6786

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-24 CWE-22

Affected software

Vendor	Product	Versions
Moxa	MXview One Series	< 1.4

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05Third Party Advisory, US Government Resource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240735-multiple-vulnerabilities-in-mxview-one-and-mxview-one-central-manager-seriesPatch, Vendor Advisory

Timeline

Published: Sep 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-67875.9This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By CVE-2024-67889.8A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the prede CVE-2024-67896.5A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allo CVE-2024-67906.1Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver CVE-2024-67917.8A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Succe CVE-2024-67923.5The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.CVE-2024-67939.8A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Succ CVE-2024-67949.8A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution CVE-2024-67959.8In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attack CVE-2024-67969.1In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauth CVE-2024-67974.8The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2024-67984.8The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s