exploit the possibilities

Moxa MiiNePort Weak Credential Management / CSRF

Moxa MiiNePort Weak Credential Management / CSRF
Posted May 3, 2016
Authored by Karn Ganeshen

Moxa MiiNePort suffers from cross site request forgery, weak credential management, and sensitive information protection vulnerabilities.

tags | advisory, vulnerability, csrf
advisories | CVE-2016-2285, CVE-2016-2286, CVE-2016-2295
MD5 | 92a9adf18f62186fdffb40720a4c11fc

Moxa MiiNePort Weak Credential Management / CSRF

Change Mirror Download
*Moxa MiiNePort - Multiple Vulnerabilities*


Multiple vulnerabilities are present in Moxa MiiNePort. Following versions
have been verified, but it is highly probable all other versions are
affected as well.


*About*


Moxa provides a full spectrum of quality products for industrial
networking, computing, and automation, and maintains a distribution and
service network that reaches customers in more than 70 countries. Our
products have connected over 30 million devices worldwide in a wide range
of applications, including factory automation, smart rail, smart grid,
intelligent transportation, oil & gas, marine, and mining. By continually
improving staff expertise in a variety of technologies and markets, we aim
to be the first choice for industrial automation solutions.


Moxa's embedded serial-to-Ethernet device server modules are small, consume
less power, and integration is easy.

The embedded serial-to-Ethernet device servers modules consist of the
MiiNePort serial device server series and the NE device server module
series.


Moxa’s MiiNePort E3 series embedded device servers are designed for
manufacturers who want to add sophisticated network connectivity to their
serial devices with minimal integration effort. The MiiNePort E3 is
empowered by the MiiNe, Moxa’s second generation SoC, which supports 10/100
Mbps Ethernet, up to 921.6 kbps serial baudrate, a versatile selection of
ready-to-use operation modes, and requires only a small amount of power. By
using Moxa’s innovative NetEZ technology, the MiiNePort E3 can be used to
convert any device with a standard serial interface to an Ethernet enabled
device in no time. In addition, the MiiNePort E3 is a compact embedded
device server with an RJ45 connector, making it easy to fit into virtually
any existing serial device.


http://www.moxa.com/product/MiiNePort_E1.htm

http://www.moxa.com/product/MiiNePort_E2.htm

http://www.moxa.com/product/MiiNePort_E3.htm



*Confirmed Device Models + Firmware versions*
Device name MiiNePort_E1_7080
Firmware version 1.1.10 Build 09120714

Device name MiiNePort_E1_4641
Firmware version 1.1.10 Build 09120714

Device name MiiNePort_E2_1242
Firmware version 1.1 Build 10080614

Device name : MiiNePort_E2_4561
Firmware version : 1.1 Build 10080614

Model name MiiNePort E3
Firmware version 1.0 Build 11071409


*Vulnerability Summary*

1. Weak Credentials Management - CVE-2016-2286

2. Sensitive information not protected - CVE-2016-2295

3. Vulnerable to Cross-Site Request Forgery - CVE-2016-2285


*Vulnerability Description*


1. *Weak Credentials Management*

By default, no password is set on the device / application. The device /
application does not enforce a mandatory password change mechanism, forcing
users to a) set/change the password on first login, b) ensure the password
meets complexity requirements, and c) change password periodically.

This allows anyone to access the device over HTTP and Telnet. Access to the
device provides full administrative functionality.

2. *Sensitive information not protected*

Information such as Connect passwords, SNMP community strings is not
protected and shown in clear-text when viewing and / or downloaded device
config (HTTP / Telnet).


3. Vulnerable to Cross-Site Request Forgery

There is no CSRF Token generated per page and / or per (sensitive)
function. Successful exploitation of this vulnerability allows silent
execution of unauthorized actions on the device such as password change,
configuration parameter changes, saving modified configuration, & device
reboot.

+++++
--
Best Regards,
Karn Ganeshen


Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    9 Files
  • 26
    Nov 26th
    11 Files
  • 27
    Nov 27th
    15 Files
  • 28
    Nov 28th
    9 Files
  • 29
    Nov 29th
    2 Files
  • 30
    Nov 30th
    17 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close