Connect with us

Hi, what are you looking for?



Critical Vulnerability Found in Moxa Servers, Gateways

Several products from industrial networking and automation solutions provider Moxa are plagued by a critical vulnerability. The vendor has released firmware updates for many of the affected devices.

Several products from industrial networking and automation solutions provider Moxa are plagued by a critical vulnerability. The vendor has released firmware updates for many of the affected devices.

Security researcher Maxim Rupp discovered that some Moxa serial device servers and cellular IP gateways are affected by a flaw that can be exploited to brute force their authentication mechanism and gain access to the vulnerable system (CVE-2016-5799).

The expert also determined that the products are exposed to attacks due to a less severe issue related to the storage of plaintext passwords in configuration files (CVE-2016-5812).

According to an advisory published by ICS-CERT on Tuesday, the security holes affect OnCell G3100V2, G3111, G3151, G3211 and G3251 gateways, which allow organizations to connect serial or ethernet devices to a cellular network. The products are used in various sectors, primarily in Europe and Asia.

However, Rupp told SecurityWeek that the authentication bypass flaw, which has a CVSS score of 9.8, also impacts OnCell G3150 gateways, OnCell 5004 industrial routers, NPort 6150 and 6450 secure terminal servers, and NPort 5250A and MiiNePort E2 serial device servers.

ICS Cyber Security ConferenceThe vulnerabilities can be exploited remotely and the researcher said he identified roughly 400 Internet-connected Moxa devices in the past year.

Rupp reported the issues to ICS-CERT in December 2015. Moxa appears to have released firmware updates that address the vulnerabilities in OnCell products in late July and early August.

Last month, Rupp was credited for finding a critical authentication bypass vulnerability (CVE-2016-5804) in Moxa MGate, a serial-to-ethernet modbus gateway used by organizations around the world.

Another critical flaw was found by Zhou Yu of Acorn Network Security in Moxa SoftCMS, a central management software for large-scale surveillance systems. The weakness, disclosed earlier this month by ICS-CERT, is a SQL injection (CVE-2016-5792) that allows a remote attacker to access the vulnerable product.

Advertisement. Scroll to continue reading.

Related: Learn More at SecurityWeek’s 2016 ICS Cyber Security Conference

Related: Serious Vulnerabilities Found in Moxa Industrial Secure Routers

Related: Unpatched Flaws Plague Moxa Connectivity Products

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...


Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.


Wago has patched critical vulnerabilities that can allow hackers to take complete control of its programmable logic controllers (PLCs).


Cybersecurity firm Forescout shows how various ICS vulnerabilities can be chained for an exploit that allows hackers to cause damage to a bridge.

Cybersecurity Funding

Internet of Things (IoT) and Industrial IoT security provider Shield-IoT this week announced that it has closed a $7.4 million Series A funding round,...


More than 1,300 ICS vulnerabilities were discovered in 2022, including nearly 1,000 that have a high or critical severity rating.