CVE-2025-0193

Medium

Description

A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability to inject malicious scripts that are continuously stored on the device. These scripts are executed when other users access the login page, potentially resulting in unauthorized actions or other impacts, depending on the user's privileges.

SeverityMedium

CVSS5.2

Exploit probability24. percentile0.3%

ProductMGate 5121 Series

PublishedJan 15, 2025

First seenJan 15, 2025

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Vendor advisories

moxa.com/en/support/product-support/security-advisory/mpsa-247733-cve-2025-0193-stored-cross-site-scripting-(xss)-vulnerability-in-the-mgate-5121-5122-5123-series

Affected products

Product	Affected versions	Fixed in
Moxa MGate 5121 Series	1.0	—
Moxa MGate 5122 Series	1.0	—
Moxa MGate 5123 Series	1.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.