Security Advisory

CVE-2021-32974: Moxa NPort IAW5000A-I/O Serial Device Server Unauthenticated OS Command Injection

Last updated:
  • CVE-2021-32974

CVE-2021-32974 is an OS command injection vulnerability (CWE-78) in the built-in web server of Moxa's NPort IAW5000A-I/O series, a wireless serial device server used to bridge RS-232/422/485 equipment onto a network; a remote attacker needs no authentication to exploit improper input validation in that web server and execute arbitrary operating-system commands on the device, and NVD's own Primary analysis scores it 9.8 (critical) on the CVSS v3.1 scale, matching the score CISA's own ICS advisory independently calculated for the same flaw.

Vulnerability summary

9.8

Critical

2.7%

EPSS score (FIRST)

No

CISA KEV catalog

2022-04-01

Published

Vulnerability ID: CVE-2021-32974 · Source: NVD

Affected components

ComponentCPEVersion range
Moxa NPort IAW5000A-I/O wireless serial device server firmware—NPort IAW5150A-6I/O, IAW5150A-12I/O, IAW5250A-6I/O and IAW5250A-12I/O firmware version 2.2 or earlier; Moxa advisory MPSA-210501 directs affected users to contact Moxa Technical Support for a security patch

What does this mean for affected devices?

CVE-2021-32974 (CWE-78, OS command injection) affects Moxa's NPort IAW5000A-I/O series wireless serial device server. NVD's description states: "Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands" (NVD).

CISA's ICS advisory ICSA-21-187-01, published 2021-07-06, names the affected models as NPort IAW5150A-6I/O, IAW5150A-12I/O, IAW5250A-6I/O and IAW5250A-12I/O running firmware 2.2 or earlier, and credits Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar with reporting it alongside three related web-server flaws in the same product line: a classic buffer overflow (CVE-2021-32968, CVSS 7.5), a stack-based buffer overflow (CVE-2021-32976, CVSS 9.8) and a separate improper-input-validation issue (CVE-2021-32970, CVSS 7.5) (CISA ICS Advisory ICSA-21-187-01). Moxa's own security advisory, MPSA-210501 (V1.0, 2021-05-27), covers the same NPort IAW5000A-I/O web-server issues and states that affected firmware is "Version 2.2 or lower," directing customers to "contact Moxa Technical Support for a security patch" rather than a self-service download (Moxa Security Advisory MPSA-210501).

NVD's own Primary analysis assigns a CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required. CISA's advisory independently computed the identical score and vector for this CVE, so both the NVD Primary and CISA-published figures agree (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02697 (86.003rd percentile) as of 2026-11-07 — notably higher than a median CVE, consistent with this being an unauthenticated, network-reachable command-injection flaw (CISA KEV, FIRST EPSS).

Operators of affected NPort IAW5000A-I/O units should contact Moxa Technical Support for the security patch referenced in MPSA-210501, and in the meantime should keep the device's web management interface off any network reachable by untrusted hosts, consistent with CISA's standing guidance to isolate control-system devices behind firewalls and use VPNs for remote access.

How to fix this class of issueThis advisory's weakness class is Command injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix command injection in embedded firmware.

Evidence

  • Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands. — NVD
  • CISA ICSA-21-187-01 (2021-07-06): affects NPort IAW5150A-6I/O, IAW5150A-12I/O, IAW5250A-6I/O and IAW5250A-12I/O firmware 2.2 or earlier; reported by Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar, alongside three related web-server flaws (CVE-2021-32968, CVE-2021-32976, CVE-2021-32970). — CISA ICS Advisory ICSA-21-187-01
  • Moxa Security Advisory MPSA-210501 (V1.0, 2021-05-27) covers the NPort IAW5000A-I/O web-server vulnerabilities for firmware 2.2 or lower and directs customers to contact Moxa Technical Support for a security patch. — Moxa Security Advisory MPSA-210501
  • NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching CISA's independently published score for the same CVE. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02697 (86.003rd percentile) as of 2026-11-07. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2023-0888: B. Braun Battery Pack SP with Wi-Fi Code-Injection Flaw Grants Root Access to an Infusion-Pump Communication Module — CVSS 7.2, High severityCVE-2023-0888: an authenticated attacker who already holds a B. Braun Battery Pack SP with Wi-Fi infusion-pump communication module's web-server credentials can exploit a code-injection flaw to gain root administrative access to the module. NVD Primary CVSS 7.2; sourced to NVD, CISA and B. Braun.CVE-2023-1389: TP-Link Archer AX21 Command Injection — CVSS 8.8, High severityCISA KEVCVE-2023-1389: KEV command injection in TP-Link Archer AX21 (AX1800) web management lets unauthenticated attackers run root commands; weaponized by Mirai variants. Sourced to NVD, CISA and Tenable.CVE-2023-1698: WAGO PFC100/PFC200 Unauthenticated OS Command Injection via Web-Based ManagementCVE-2023-1698: an OS command injection flaw in the web-based management interface of WAGO's PFC100, PFC200, Compact Controller 100, Edge Controller and Touch Panel 600 firmware lets an unauthenticated remote attacker create new users, change the device configuration and run arbitrary commands. CERT@VDE rates it 9.8 (CVSS v3.1); NVD has not yet published its own Primary score.

Sources

  1. NVD
  2. CISA ICS Advisory ICSA-21-187-01
  3. Moxa Security Advisory MPSA-210501
  4. CISA KEV
  5. FIRST EPSS