Critical severity · published Aug 24, 2016
CVE-2016-5799
Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote…
9.8
CVSS
4%
EPSS
No
On KEV
Description
Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OG
Oncell G3001 Firmware · Moxa
through 1.6 · source: NVD
OG
Oncell G3100v2 Firmware · Moxa
through 2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5799
www.securityfocus.com
http://www.securityfocus.com/bid/92606
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01
More from Oncell G3001 Firmware
3.3
CVE-2016-5812
Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain…