Cross site request forgery (csrf)

A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

CVE-2017-7915

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions,...

Code injection

A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

CVE-2017-7917

A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

CVE-2017-7917

CVE-2017-7917 describes a Cross-Site Request Forgery in Moxa OnCell devices (G3110-HSPA, G3110-HSDPA, G3150-HSDPA, 5104-HSDPA/HSPA, 5004-HSPA). The issue arises because the application does not sufficiently verify that a request originated from the user they claim, allowing an attacker to modify ...

CVE-2017-7913

CVE-2017-7913 affects Moxa OnCell devices (G3110-HSPA/G3110-HSDPA, G3150-HSDPA, 5104-HSDPA/HSPA, 5004-HSPA). Root cause: the device configuration files store passwords in plaintext, enabling potential credential exposure. Impact stated in sources ranges from partial confidentiality loss to authen...

CVE-2017-7915

CVE-2017-7915 affects multiple Moxa OnCell devices (G3110-HSPA, G3110-HSDPA, G3150-HSDPA, 5104-HSDPA, 5104-HSPA, 5004-HSPA). The issue is an Improper Restriction of Excessive Authentication Attempts, enabling brute-force attempts to determine authentication parameters and bypass authentication. A...

CVE-2017-7913

A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

CVE-2017-7915

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions,...

Moxa OnCell

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Moxa Equipment: OnCell Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Plaintext Storage of a Password, and Cross-Site Request Forgery AFFECTED PRODUCTS The following versions of OnCell, a...

CVE-2016-8362

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series...

Design/Logic Flaw

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series...

CVE-2016-8362

CVE-2016-8362 affects Moxa OnCell OnCellG3470A-LTE and a wide range of AWK/WAC/TAP models. The issue is described as Improper Authentication that allows any user to download log files by accessing a specific URL, with an attack scenario that does not require authentication. Impact in the public a...

CVE-2016-8362

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series...

CVE-2016-8363

CVE-2016-8363 affects Moxa OnCell gateways (OnCellG3470A-LTE, AWK-1131A/3131A/4131A, AWK-3191, AWK-5232/6232, AWK-1121/1127, WAC-1001 V2, WAC-2004, AWK-3121-M12-RTG, AWK-3131-M12-RCC, AWK-5232-M12-RCC, TAP-6226, AWK-3121/4121, AWK-3131/4131, AWK-5222/6222). The root cause is an improper auth/perm...

Moxa OnCell Series Product Validation Bypass Vulnerability

MOXA OnCell is an industrial grade IP gateway product. The Moxa OnCell Series product authentication bypass vulnerability can be exploited by an attacker to bypass authentication mechanisms and gain unauthorized access...

Moxa OnCell Series Products OS Command Execution Vulnerability

MOXA OnCell is an industrial grade IP gateway product. An OS command execution vulnerability exists in Moxa OnCell Series products, which can be exploited by an attacker to execute arbitrary OS commands...

Cross-Site Scripting Vulnerability in Multiple Moxa Products

Moxa OnCell G3100 and others are IP gateway products from Moxa. A cross-site scripting vulnerability exists in multiple Moxa products, which can be exploited by an attacker to execute arbitrary script code in a user's browser...

Moxa OnCell Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-236-01 Moxa OnCell Vulnerabilities that was published August 23, 2016, on the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified several vulnerabilities in Moxa’s OnCell products. Moxa has...

CVE-2016-5799

Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...