CVE-2018-11422

Опубликовано: 03 июл. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication.

Ссылки

https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md
Third Party Advisory
https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:moxa:oncell_g3150-hspa_firmware:*:*:*:*:*:*:*:*

Версия до 1.6 (включая)

cpe:2.3:h:moxa:oncell_g3150-hspa:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:moxa:oncell_g3150-hspa-t_firmware:*:*:*:*:*:*:*:*

Версия до 1.6 (включая)

cpe:2.3:h:moxa:oncell_g3150-hspa-t:-:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.0023

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-319

Связанные уязвимости

GHSA-j89h-7gpj-6wwq

github

больше 3 лет назад

BDU:2020-01239