CVE-2021-32974: Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute…

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

2.59%

83.6th percentile

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
moxa	nport_iaw5000a-i_o_series_firmware	unspecified – 2.2	—
moxa	nport_iaw5150a-12i_o_firmware	<= 2.2	—
moxa	nport_iaw5150a-6i_o_firmware	<= 2.2	—
moxa	nport_iaw5250a-12i_o_firmware	<= 2.2	—
moxa	nport_iaw5250a-6i_o_firmware	<= 2.2	—

Detection & IOCsextracted from sources · hover to see the quote

→CVE-2021-32974 is an OS Command Injection (CWE-78) vulnerability in the built-in web server of Moxa NPort IAW5000A-I/O Series firmware. Detection should focus on anomalous or unexpected HTTP requests to the device's built-in web server that contain shell metacharacters or command injection payloads. ↗
→The vulnerability is exploitable remotely with low attack complexity and requires no authentication (CVSS AV:N/AC:L/PR:N/UI:N), so any unauthenticated HTTP traffic to the NPort IAW5000A-I/O web server interface should be treated as suspicious and monitored. ↗
→Affected product is Moxa NPort IAW5000A-I/O Series firmware Version 2.2 or earlier. Identify and inventory all such devices on the network as targets for exploitation attempts. ↗

·No known public exploits specifically target this vulnerability at the time of advisory publication, limiting the availability of concrete exploit-based IOCs. ↗
·The advisory does not disclose the specific web server endpoint, parameter name, or payload format used to trigger the OS command injection, making precise signature-based detection difficult without further research or vendor disclosure. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.