Moxa MiiNePort E1 - Broken Access Control

published 2023-04-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-32340

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 21 mo ago (2025-01-31)

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Moxa MiiNePort E1

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

twcert.org.tw /tw/cp-132-7021-eb43a-1.html
third-party-advisory
cdn-cms.azureedge.net /Moxa/media/PDIM/S100000223/MiiNePort%20E1%20Series_moxa-miineport-e1-series-firmware-v1.9.rom_Software%20Rele
release-notes

Sources

CVE List CVE-2023-28697
NVD CVE-2023-28697

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary