How severe is CVE-2019-18242?

CVE-2019-18242 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-18242 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-18242?

CVE-2019-18242 primarily affects Moxa Iologik 2512 Firmware. In total, 20 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-18242?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-18242 published?

CVE-2019-18242 was published on 2020-03-24 and last updated on 2026-06-17.

CVE-2019-18242

CVE-2019-18242 is a high-severity vulnerability in Moxa Iologik 2512 Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-941.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (67th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-941
Affected product: Moxa Iologik 2512 Firmware
Published: 2020-03-24
Last modified: 2026-06-17

Description

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail.

Frequently asked questions

What is CVE-2019-18242?: In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail.
How severe is CVE-2019-18242?: CVE-2019-18242 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-18242 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-18242?: CVE-2019-18242 primarily affects Moxa Iologik 2512 Firmware. In total, 20 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-18242?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-18242 published?: CVE-2019-18242 was published on 2020-03-24 and last updated on 2026-06-17.

References

https://www.us-cert.gov/ics/advisories/icsa-20-056-02

Affected products (20)

cpe:2.3:o:moxa:iologik_2512_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-hspa_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-hspa-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-eu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-eu-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-us_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-us-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-jp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2512-wl1-jp-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-hspa_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-hspa-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-eu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-eu-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-us_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-us-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-jp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:moxa:iologik_2542-wl1-jp-t_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Moxa Iologik 2512 Firmware

CVE-2020-7003 — High (CVSS 7.5): In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…
CVE-2019-18238 — High (CVSS 7.5): In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…

All CVEs affecting Moxa Iologik 2512 Firmware →

Other CWE-941 vulnerabilities

CVE-2024-34947 — Critical (CVSS 9.4): Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be…
CVE-2025-69515 — Critical (CVSS 9.1): An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system…
CVE-2025-53899 — High (CVSS 7.2): Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is…
CVE-2022-4847 — Medium (CVSS 6.5): Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2026-40118 — Medium (CVSS 6.3): UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel…
CVE-2023-33198 — Medium (CVSS 6.1): tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache…

Browse all CWE-941 vulnerabilities →