CISA has published an advisory on session fixation, improper privilege management, weak password requirements, cleartext transmission of sensitive information, improper restriction of excessive authentication attempts, and exposure of sensitive information to an unauthorized actor vulnerabilities in MOXA NPort IAW5000A-I/O Series. Firmware Version 2.1 or lower is affected. Successful exploitation of these vulnerabilities could allow an attacker to gain access to and hijack a session; allow an attacker with user privileges to perform requests with administrative privileges; allow the use of weak passwords; allow credentials of third-party services to be transmitted in cleartext; allow the use of brute force to bypass authentication on an SSH/Telnet session; or allow access to sensitive information without proper authorization. Moxa has released an updated firmware version or the NPort IAW5000A-I/O Series and recommends users install this update on all affected systems. CISA also advised on a series of measures to mitigate the vulnerabilities. Read the advisory at CISA.