CVE-2020-25198
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.19%
- CWE
- CWE-384
- Published
- 2020-12-23
- Last modified
- 2026-03-14
Affected products
- MOXA NPort IAW5000A-I/O
Weakness type
Related vulnerabilities
- CVE-2024-11317 — PHP Session Fixation
- CVE-2024-38513 — Fiber Session Middleware Token Injection Vulnerability
- CVE-2025-59841 — FlagForgeCTF's Improper Session Handling Allows Access After Logout
- CVE-2025-52689 — Weak Session ID Check in the OmniAccess Stellar Web Management Interface
- CVE-2024-13967 — ession-Management Failure
- CVE-2024-45368 — AutomationDirect DirectLogic H2-DM1E Session Fixation
- CVE-2022-30605 — A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f
- CVE-2026-22082 — Insecure Session ID Management Vulnerability in Tenda Wireless Routers