CVE-2016-5799

2016-08-24 04:00:24 2016-11-28 21:29:33

Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Moxa Oncell g3100v2 firmware 2.7 (not an official CPE) Moxa Oncell g3001 firmware 1.6 (not an official CPE)

Moxa - Oncell g3100v2 firmware Moxa - Oncell g3001 firmware

Advisory	Patch	Confirmed	Link
			92606
			https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01

Improper Authorization (ID 285)

Related CAPEC 13 Accessing Functionality Not Properly Constrained by ACLs (CAPEC-ID 1) Cross Zone Scripting (CAPEC-ID 104) Directory Indexing (CAPEC-ID 127) Subverting Environment Variable Values (CAPEC-ID 13) Accessing, Modifying or Executing Executable Files (CAPEC-ID 17) Manipulating Opaque Client-based Data Tokens (CAPEC-ID 39) Buffer Overflow via Symbolic Links (CAPEC-ID 45) Poison Web Service Registry (CAPEC-ID 51) Session Credential Falsification through Prediction (CAPEC-ID 59) Reusing Session IDs (aka Session Replay) (CAPEC-ID 60) Manipulating Input to File System Calls (CAPEC-ID 76) Manipulating User-Controlled Variables (CAPEC-ID 77) Forceful Browsing (CAPEC-ID 87)