What’s Vulnerable › Vulnerabilities

CVE-2020-24052

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-08-21 · updated 2026-06-17
• Weakness: CWE-611

Description

Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request.

Affected products

• Moog Exvf5C-2 Firmware: all versions
• Moog Exvp7C2-3 Firmware: all versions

References

• https://ioac.tv/3hy1xu6
• https://ioactive.com/moog-exo-series-multiple-vulnerabilities/
• https://ioac.tv/3hy1xu6
• https://ioactive.com/moog-exo-series-multiple-vulnerabilities/

Get alerted when CVE-2020-24052 or the next vulnerability affects your stack