// For flags

CVE-2018-11421

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to remote unauthenticated disclosure of sensitive information, including the administrator's password. Under certain conditions, it's also possible to retrieve additional information, such as content of HTTP requests to the device, or the previously used password, due to memory leakages.

Moxa OnCell serie G3100-HSPA versión 1.6 Build 17100315 y anteriores usa un protocolo de monitoreo propietario que no proporciona controles de seguridad de confidencialidad, integridad y autenticidad. Toda la información se envía en texto plano, y puede ser interceptada y modificada. El protocolo es vulnerable a la divulgación remota no autenticada de información confidencial, incluida la contraseña del administrador. Bajo ciertas condiciones, también es posible recuperar información adicional, como el contenido de las solicitudes HTTP al dispositivo, o la contraseña utilizada anteriormente, debido a fugas de memoria.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-24 CVE Reserved
  • 2019-07-03 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-319: Cleartext Transmission of Sensitive Information
CAPEC
References (1)
URL Tag Source
https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-103.md Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Moxa
Search vendor "Moxa"
 Oncell G3150-hspa Firmware
Search vendor "Moxa" for product "Oncell G3150-hspa Firmware"
 <= 1.6
Search vendor "Moxa" for product "Oncell G3150-hspa Firmware" and version " <= 1.6"
-
Affected
in Moxa
Search vendor "Moxa"
 Oncell G3150-hspa
Search vendor "Moxa" for product "Oncell G3150-hspa"
--
Safe
Moxa
Search vendor "Moxa"
 Oncell G3150-hspa-t Firmware
Search vendor "Moxa" for product "Oncell G3150-hspa-t Firmware"
 <= 1.6
Search vendor "Moxa" for product "Oncell G3150-hspa-t Firmware" and version " <= 1.6"
-
Affected
in Moxa
Search vendor "Moxa"
 Oncell G3150-hspa-t
Search vendor "Moxa" for product "Oncell G3150-hspa-t"
--
Safe