CVE-2016-8350: Cross-Site Request Forgery (CSRF)

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-8346: Insertion of Sensitive Information into Log File

An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access configuration and log files PRIVILEGE ESCALATION...

CVE-2016-9346: Undefined Security Weakness

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted...

CVE-2016-8359: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-9363: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

PT-2017-10066

Name of the Vulnerable Software and Affected Versions Moxa SoftCMS versions prior to 1.6 Description The issue allows a remote attacker to gain access with administrator privileges through specially crafted input, leveraging a SQL injection technique. This occurs because the SoftCMS Application...

PT-2017-10094

Name of the Vulnerable Software and Affected Versions Moxa NPort 5110 versions prior to 2.6 Moxa NPort 5130/5150 Series versions prior to 3.6 Moxa NPort 5200 Series versions prior to 2.8 Moxa NPort 5400 Series versions prior to 3.11 Moxa NPort 5600 Series versions prior to 3.7 Moxa NPort 5100A...

PT-2017-9639

Name of the Vulnerable Software and Affected Versions Moxa OnCell OnCellG3470A-LTE versions affected versions not specified Moxa AWK-1131A/3131A/4131A Series versions affected versions not specified Moxa AWK-3191 Series versions affected versions not specified Moxa AWK-5232/6232 Series versions...

PT-2017-10074

Name of the Vulnerable Software and Affected Versions Moxa MiiNePort E1 versions prior to 1.8 Moxa MiiNePort E2 versions prior to 1.4 Moxa MiiNePort E3 versions prior to 1.1 Description An issue allows an attacker to potentially brute force an active session cookie, enabling them to download...

Moxa ioLogik E1200 Series Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-287-05 Moxa ioLogik E1200 Series Vulnerabilities that was published October 13, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 4 -------- Alexandru Ariciu of Applied Risk has identified...

Moxa DACenter Local Elevation of Privilege Vulnerability

Moxa DACenter is an OPC interface from Moxa that interacts with the Moxa Active OPC server for real-time data collection. A local privilege vulnerability exists in Moxa DACenter version 1.4 and earlier. An attacker could exploit this vulnerability to gain elevated privileges...

Moxa DACenter Denial of Service Vulnerability

Moxa DACenter is an OPC interface from Moxa that interacts with the Moxa Active OPC server for real-time data collection. A denial of service vulnerability exists in Moxa DACenter 1.4 and prior versions. A local attacker could exploit this vulnerability to gain elevated privileges or cause a deni...

Moxa MiiNePort Multiple Vulnerabilities (Dec 2016)

Moxa MiiNePort is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:moxa:miineport"; if...

Moxa MiiNePort Session Hijacking Vulnerability

Moxa MiiNePort is an embedded device networking module from Moxa designed for manufacturers to connect serial devices to a network connection. A security vulnerability exists in Moxa MiiNePort. An attacker could use this vulnerability to brute-force decode session cookies and download configurati...

Moxa MiiNePort Detection (Telnet)

Telnet based detection of Moxa MiiNePort devices. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of Service Vulnerability in Moxa NPort5110 TCP/IP Stack

Moxa NPort5110 is an industrial-grade serial server manufactured by Moxa Taiwan for serial device networking. A denial of service vulnerability exists in the Moxa NPort5110 TCP/IP stack. Sending 1-2 UDP length anomaly messages to the NPort5110's UDP port 161 SNMP can cause the NPort5110's TCP/IP...

Moxa ioLogik E2200 Series Weak Authentication Practices

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-15-224-04 Moxa ioLogik E2210 VulnerabilitiesICS-ALERT-15-224-04 Moxa ioLogik E2210 Vulnerabilities, https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-04, web site last accessed March 03, 2016. that was published August 12, 201...

Moxa NPort Access Control Vulnerability

MOXA Nport is a serial communication server. An access control vulnerability exists in the Moxa NPort. An unauthenticated attacker can exploit the vulnerability to update the firmware and execute arbitrary code...

Moxa NPort Cross-Site Request Forgery Vulnerability

MOXA Nport is a serial communication server. A cross-site request forgery vulnerability exists in Moxa NPort. An attacker can exploit the vulnerability to launch a cross-site request attack because a user-submitted request is not validated...

Moxa NPort Credential Management Vulnerability

MOXA Nport is a serial communication server. A credential management vulnerability exists in the Moxa NPort. An unauthenticated attacker could exploit the vulnerability to obtain the administrator password...