CVE-2016-9365 : An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/515

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Requests are not verified to be intentionally submitted by the proper user (CROSS-SITE REQUEST FORGERY).

Published 2017-02-13 21:59:02

Updated 2017-02-17 18:09:21

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2016-9365

Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 3.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5130 » Version: N/A
When used together with: Moxa » Nport 5150 » Version: N/A
Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 2.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110 » Version: N/A
Moxa » Nport 5200 Series Firmware
Versions up to, including, (<=) 2.7
cpe:2.3:o:moxa:nport_5200_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210 » Version: N/A
When used together with: Moxa » Nport 5230 » Version: N/A
When used together with: Moxa » Nport 5232 » Version: N/A
When used together with: Moxa » Nport 5232i » Version: N/A
Moxa » Nport 5400 Series Firmware
Versions up to, including, (<=) 3.10
cpe:2.3:o:moxa:nport_5400_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5410 » Version: N/A
When used together with: Moxa » Nport 5430 » Version: N/A
When used together with: Moxa » Nport 5430i » Version: N/A
When used together with: Moxa » Nport 5450 » Version: N/A
When used together with: Moxa » Nport 5450-t » Version: N/A
When used together with: Moxa » Nport 5450i » Version: N/A
When used together with: Moxa » Nport 5450i-t » Version: N/A
Moxa » Nport 5600 Series Firmware
Versions up to, including, (<=) 3.6
cpe:2.3:o:moxa:nport_5600_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610 » Version: N/A
When used together with: Moxa » Nport 5630 » Version: N/A
When used together with: Moxa » Nport 5650 » Version: N/A
Moxa » Nport 5100a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5100a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110a » Version: N/A
When used together with: Moxa » Nport 5130a » Version: N/A
When used together with: Moxa » Nport 5150a » Version: N/A
Moxa » Nport P5150a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_p5150a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport P5110a » Version: N/A
Moxa » Nport 5200a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5200a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210a » Version: N/A
When used together with: Moxa » Nport 5230a » Version: N/A
When used together with: Moxa » Nport 5250a » Version: N/A
Moxa » Nport 5x50a1-m12 Series Firmware
Versions up to, including, (<=) 1.1
cpe:2.3:o:moxa:nport_5x50a1-m12_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5150a1-m12 » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12 » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12 » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-t » Version: N/A
Moxa » Nport 5600-8-dtl Series Firmware
Versions up to, including, (<=) 2.3
cpe:2.3:h:moxa:nport_5600-8-dtl_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650i-8-dtl » Version: N/A
Moxa » Nport 6100 Series Firmware
Versions up to, including, (<=) 1.13
cpe:2.3:o:moxa:nport_6100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 6150 » Version: N/A
When used together with: Moxa » Nport 6150-t » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-9365

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9365

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-9365

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-9365

http://www.securityfocus.com/bid/85965

Multiple Moxa NPort Products ICSA-16-336-02 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02

Moxa NPort Device Vulnerabilities (Update A) | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2016-9365

Products affected by CVE-2016-9365

Exploit prediction scoring system (EPSS) score for CVE-2016-9365

CVSS scores for CVE-2016-9365

CWE ids for CVE-2016-9365

References for CVE-2016-9365