CVE-2016-9361 : An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 52

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating.

Published 2017-02-13 21:59:02

Updated 2017-02-17 18:08:22

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2016-9361

EPSS FAQ

31.91%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2016-9361

Moxa UDP Device Discovery

First seen: 2020-04-26

auxiliary/scanner/scada/moxa_discover

The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. A discovery packet compels a Moxa device to respond to the sender

More information
Moxa Device Credential Retrieval

Disclosure Date: 2015-07-28

First seen: 2020-04-26

auxiliary/admin/scada/moxa_credentials_recovery

The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. Many devices with firmware versions older than 2017 or late 2016 allow admin creden

More information

CVSS scores for CVE-2016-9361

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-9361

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-9361

http://www.securityfocus.com/bid/85965

Multiple Moxa NPort Products ICSA-16-336-02 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02

Moxa NPort Device Vulnerabilities (Update A) | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url

Products affected by CVE-2016-9361

Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 3.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5130 » Version: N/A
When used together with: Moxa » Nport 5150 » Version: N/A
Moxa » Nport 5100 Series Firmware
Versions up to, including, (<=) 2.5
cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110 » Version: N/A
Moxa » Nport 5200 Series Firmware
Versions up to, including, (<=) 2.7
cpe:2.3:o:moxa:nport_5200_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210 » Version: N/A
When used together with: Moxa » Nport 5230 » Version: N/A
When used together with: Moxa » Nport 5232 » Version: N/A
When used together with: Moxa » Nport 5232i » Version: N/A
Moxa » Nport 5400 Series Firmware
Versions up to, including, (<=) 3.10
cpe:2.3:o:moxa:nport_5400_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5410 » Version: N/A
When used together with: Moxa » Nport 5430 » Version: N/A
When used together with: Moxa » Nport 5430i » Version: N/A
When used together with: Moxa » Nport 5450 » Version: N/A
When used together with: Moxa » Nport 5450-t » Version: N/A
When used together with: Moxa » Nport 5450i » Version: N/A
When used together with: Moxa » Nport 5450i-t » Version: N/A
Moxa » Nport 5600 Series Firmware
Versions up to, including, (<=) 3.6
cpe:2.3:o:moxa:nport_5600_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610 » Version: N/A
When used together with: Moxa » Nport 5630 » Version: N/A
When used together with: Moxa » Nport 5650 » Version: N/A
Moxa » Nport 5100a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5100a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5110a » Version: N/A
When used together with: Moxa » Nport 5130a » Version: N/A
When used together with: Moxa » Nport 5150a » Version: N/A
Moxa » Nport P5150a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_p5150a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport P5110a » Version: N/A
Moxa » Nport 5200a Series Firmware
Versions up to, including, (<=) 1.2
cpe:2.3:o:moxa:nport_5200a_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5210a » Version: N/A
When used together with: Moxa » Nport 5230a » Version: N/A
When used together with: Moxa » Nport 5250a » Version: N/A
Moxa » Nport 5x50a1-m12 Series Firmware
Versions up to, including, (<=) 1.1
cpe:2.3:o:moxa:nport_5x50a1-m12_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5150a1-m12 » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5150a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12 » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5250a1-m12-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12 » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-ct-t » Version: N/A
When used together with: Moxa » Nport 5450a1-m12-t » Version: N/A
Moxa » Nport 5600-8-dtl Series Firmware
Versions up to, including, (<=) 2.3
cpe:2.3:h:moxa:nport_5600-8-dtl_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 5610-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650-8-dtl » Version: N/A
When used together with: Moxa » Nport 5650i-8-dtl » Version: N/A
Moxa » Nport 6100 Series Firmware
Versions up to, including, (<=) 1.13
cpe:2.3:o:moxa:nport_6100_series_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Moxa » Nport 6150 » Version: N/A
When used together with: Moxa » Nport 6150-t » Version: N/A

Vulnerability Details : CVE-2016-9361