Lucene search

IcscertCVE-2016-9344

HistoryFeb 13, 2017 - 9:59 p.m.

CVE-2016-9344

2017-02-1321:59:01

CWE-532

icscert

web.nvd.nist.gov

moxa

miineport

cve-2016-9344

security

configuration files

brute force

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.

Affected configurations

Nvd

Node

moxamiineport_e1_firmwareRange≤1.7

moxamiineport_e2_firmwareRange≤1.3

moxamiineport_e3_firmwareRange≤1.0

AND

moxamiineport_e1Match-

moxamiineport_e2Match-

moxamiineport_e3Match-

VendorProductVersionCPE
moxamiineport_e1_firmware*cpe:2.3:o:moxa:miineport_e1_firmware:*:*:*:*:*:*:*:*
moxamiineport_e2_firmware*cpe:2.3:o:moxa:miineport_e2_firmware:*:*:*:*:*:*:*:*
moxamiineport_e3_firmware*cpe:2.3:o:moxa:miineport_e3_firmware:*:*:*:*:*:*:*:*
moxamiineport_e1-cpe:2.3:h:moxa:miineport_e1:-:*:*:*:*:*:*:*
moxamiineport_e2-cpe:2.3:h:moxa:miineport_e2:-:*:*:*:*:*:*:*
moxamiineport_e3-cpe:2.3:h:moxa:miineport_e3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moxa	miineport_e1_firmware	*	cpe:2.3:o:moxa:miineport_e1_firmware::::::::
moxa	miineport_e2_firmware	*	cpe:2.3:o:moxa:miineport_e2_firmware::::::::
moxa	miineport_e3_firmware	*	cpe:2.3:o:moxa:miineport_e3_firmware::::::::
moxa	miineport_e1	-	cpe:2.3:h:moxa:miineport_e1:-:::::::*
moxa	miineport_e2	-	cpe:2.3:h:moxa:miineport_e2:-:::::::*
moxa	miineport_e3	-	cpe:2.3:h:moxa:miineport_e3:-:::::::*

CNA Affected

[
  {
    "product": "Moxa MiiNePort",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Moxa MiiNePort"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94783

ics-cert.us-cert.gov/advisories/ICSA-16-343-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

Related for CVE-2016-9344