CVE-2016-9369 : An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/515

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Firmware can be updated over the network without authentication, which may allow remote code execution.

Published 2017-02-13 21:59:02

Updated 2017-02-17 18:12:12

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Execute codeBypassGain privilege

Products affected by CVE-2016-9369

Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 3.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5130 » Version: N/A
When used together with: Moxa » Nport 5150 » Version: N/A
Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 2.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110 » Version: N/A
Moxa » Nport 5200 Series Firmware
Versions up to, including, (<=) 2.7
cpe:2.3:o:moxa:nport_5200_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210 » Version: N/A
When used together with: Moxa » Nport 5230 » Version: N/A
When used together with: Moxa » Nport 5232 » Version: N/A
When used together with: Moxa » Nport 5232i » Version: N/A
Moxa » Nport 5400 Series Firmware
Versions up to, including, (<=) 3.10
cpe:2.3:o:moxa:nport_5400_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5410 » Version: N/A
When used together with: Moxa » Nport 5430 » Version: N/A
When used together with: Moxa » Nport 5430i » Version: N/A
When used together with: Moxa » Nport 5450 » Version: N/A
When used together with: Moxa » Nport 5450-t » Version: N/A
When used together with: Moxa » Nport 5450i » Version: N/A
When used together with: Moxa » Nport 5450i-t » Version: N/A
Moxa » Nport 5600 Series Firmware
Versions up to, including, (<=) 3.6
cpe:2.3:o:moxa:nport_5600_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610 » Version: N/A
When used together with: Moxa » Nport 5630 » Version: N/A
When used together with: Moxa » Nport 5650 » Version: N/A
Moxa » Nport 5100a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5100a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110a » Version: N/A
When used together with: Moxa » Nport 5130a » Version: N/A
When used together with: Moxa » Nport 5150a » Version: N/A
Moxa » Nport P5150a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_p5150a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport P5110a » Version: N/A
Moxa » Nport 5200a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5200a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210a » Version: N/A
When used together with: Moxa » Nport 5230a » Version: N/A
When used together with: Moxa » Nport 5250a » Version: N/A
Moxa » Nport 5x50a1-m12 Series Firmware
Versions up to, including, (<=) 1.1
cpe:2.3:o:moxa:nport_5x50a1-m12_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5150a1-m12 » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12 » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12 » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-t » Version: N/A
Moxa » Nport 5600-8-dtl Series Firmware
Versions up to, including, (<=) 2.3
cpe:2.3:h:moxa:nport_5600-8-dtl_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650i-8-dtl » Version: N/A
Moxa » Nport 6100 Series Firmware
Versions up to, including, (<=) 1.13
cpe:2.3:o:moxa:nport_6100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 6150 » Version: N/A
When used together with: Moxa » Nport 6150-t » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-9369

EPSS FAQ

0.90%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9369

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-9369

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-9369

http://www.securityfocus.com/bid/85965

Multiple Moxa NPort Products ICSA-16-336-02 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02

Moxa NPort Device Vulnerabilities (Update A) | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2016-9369

Products affected by CVE-2016-9369

Exploit prediction scoring system (EPSS) score for CVE-2016-9369

CVSS scores for CVE-2016-9369

CWE ids for CVE-2016-9369

References for CVE-2016-9369