CVE-2016-8712: moxa awk-3131a_firmware Insufficient Session Expiration

Vulnerability summary

CVE-2016-8712 is a high (CVSS 8.1) Insufficient Session Expiration vulnerability in moxa awk-3131a_firmware. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-04-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one nonce for all session authentication requests and only changes the nonce if the web application has been idle for 300 seconds.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."