CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11420
https://notcve.org/view.php?id=CVE-2018-11420
There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-11423. Existe una corrupción de memoria en la interfaz web de Moxa OnCell G3100-HSPA Series versión 1.5 Build 17042015 y anterior, una vulnerabilidad diferente a la CVE-2018-11423. • https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-101.md • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11421
https://notcve.org/view.php?id=CVE-2018-11421
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to remote unauthenticated disclosure of sensitive information, including the administrator's password. Under certain conditions, it's also possible to retrieve additional information, such as content of HTTP requests to the device, or the previously used password, due to memory leakages. Moxa OnCell serie G3100-HSPA versión 1.6 Build 17100315 y anteriores usa un protocolo de monitoreo propietario que no proporciona controles de seguridad de confidencialidad, integridad y autenticidad. • https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-103.md • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11422
https://notcve.org/view.php?id=CVE-2018-11422
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication. Moxa OnCell G3100-HSPA Series versión 1.6 Build 17100315 y versiones anteriores usan un protocolo de configuración propietario que no proporciona controles de seguridad de confidencialidad, integridad y autenticidad. Toda la información se envía en texto plano, y puede ser interceptada y modificada. • https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11423
https://notcve.org/view.php?id=CVE-2018-11423
There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420. Existe una corrupción de memoria en la interfaz web Moxa OnCell serie G3100-HSPA versión 1.6 Build 17100315 y anterior, una vulnerabilidad diferente a CVE-2018-11420. • https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-102.md • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11426
https://notcve.org/view.php?id=CVE-2018-11426
A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change. Un parámetro de Cookie débil se usa en la aplicación web de Moxa OnCell G3100-HSPA Series versión 1.4 Build 16062919 y en versiones anteriores. Un atacante puede forzar los parámetros necesarios para omitir la autenticación y acceder a la interfaz web para utilizar todas sus funciones, excepto el cambio de contraseña. • https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-105.md • CWE-287: Improper Authentication •