PT-2017-17991 · Moxa · Moxa Oncell G3150-Hsdpa+3

Publicado 2017-05-29 · Atualizado 2019-10-09 · CVE-2017-7915

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa OnCell G3110-HSPA versions 1.3 build 15082117 and previous versions Moxa OnCell G3110-HSDPA versions 1.2 Build 09123015 and previous versions Moxa OnCell G3150-HSDPA versions 1.4 Build 11051315 and previous versions Moxa OnCell 5104-HSDPA (affected versions not specified) Moxa OnCell 5104-HSPA (affected versions not specified) Moxa OnCell 5004-HSPA (affected versions not specified)

Description An issue with improper restriction of excessive authentication attempts was found, allowing an attacker to use brute force to determine parameters needed to bypass authentication.

Recommendations For Moxa OnCell G3110-HSPA versions 1.3 build 15082117 and previous versions, consider restricting access to the authentication mechanism to minimize the risk of exploitation. For Moxa OnCell G3110-HSDPA versions 1.2 Build 09123015 and previous versions, consider implementing rate limiting on authentication attempts as a temporary workaround. For Moxa OnCell G3150-HSDPA versions 1.4 Build 11051315 and previous versions, restrict access to the vulnerable authentication component until a fix is available. For Moxa OnCell 5104-HSDPA, OnCell 5104-HSPA, and OnCell 5004-HSPA, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2017-7915

Produtos afetados

Moxa Oncell 5004-Hspa

Moxa Oncell 5104-Hsdpa

Moxa Oncell G3110-Hsdpa

Moxa Oncell G3150-Hsdpa

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-7915 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7915 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-143-01 · Nota