Moxa Oncell G3150 Hspa T vulnerabilities
9 vulnerabilities
Known vulnerabilities in Moxa Oncell G3150 Hspa T, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-11421moxaoncell_g3150-hspa_firmware+1
EPSS score0.91%
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to remote unauthenticated disclosure of sensitive information, including the administrator's password. Under certain conditions, it's also possible to retrieve additional information, such as content of HTTP requests to the device, or the previously used password, due to memory leakages.CVE-2018-11420moxaoncell_g3150-hspa_firmware+1EPSS score1.54%
There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-11423.CVE-2018-11427moxaoncell_g3150-hspa_firmware+1EPSS score0.58%
CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF attacks on the device administrator.CVE-2018-11426moxaoncell_g3150-hspa_firmware+1EPSS score1.84%
A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change.CVE-2018-11423moxaoncell_g3150-hspa_firmware+1EPSS score1.36%
There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420.CVE-2018-11422moxaoncell_g3150-hspa_firmware+1EPSS score1.02%
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication.CVE-2018-5449moxaoncell_g3110-hspa_firmware+3EPSS score0.48%
A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does not check for a NULL value, allowing for an attacker to perform a denial of service attack.CVE-2018-5455moxaoncell_g3110-hspa_firmware+3EPSS score1.56%
A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing authentication and gaining access to device functions.CVE-2018-5453moxaoncell_g3110-hspa_firmware+3EPSS score1.18%
An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker may be able to edit the element of an HTTP request, causing the device to become unavailable.