Moxa Fixes NPort Device Holes

Thursday, December 1, 2016 @ 05:12 PM gHale

Moxa produced new firmware versions to mitigate vulnerabilities in its NPort serial device servers first identified in April, according to a report with ICS-CERT.

These vulnerabilities, discovered by security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp, are remotely exploitable.

RELATED STORIES
Mitsubishi Fixes One Module Vulnerability
Advantech’s New Software to Clear Holes
Medication Safety Software Hole Fixed
Liebert SiteScan Vulnerability Patched

Moxa reports the vulnerabilities affect the following versions of NPort:
• NPort 5110 versions prior to 2.6
• NPort 5130/5150 Series versions prior to 3.6
• NPort 5200 Series versions prior to 2.8
• NPort 5400 Series versions prior to 3.11
• NPort 5600 Series versions prior to 3.7
• NPort 5100A Series & NPort P5150A versions prior to 1.3
• NPort 5200A Series versions prior to 1.3
• NPort 5150AI-M12 Series versions prior to 1.2
• NPort 5250AI-M12 Series versions prior to 1.2
• NPort 5450AI-M12 Series versions prior to 1.2,
• NPort 5600-8-DT Series versions prior to 2.4
• NPort 5600-8-DTL Series versions prior to 2.4
• NPort 6×50 Series versions prior to 1.13.11
• NPort IA5450A versions prior to v1.4

Successful exploitation of these vulnerabilities could lead to the complete compromise of an affected system.

Moxa is a Taiwan-based company that maintains offices in several countries around the world, including the U.S., UK, India, Germany, France, China, Russia, and Brazil.

The affected products, NPort devices, connect serial devices to Ethernet networks. NPort devices see action across several sectors including critical manufacturing, energy, and transportation systems. Moxa said these products see use on a global basis.

In one vulnerability, administration passwords can end up retried without authenticating.

CVE-2016-9361 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In addition, firmware can end up updated over the network without authentication, which may allow remote code execution.

CVE-2016-9369 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

Also, a buffer overflow vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code.

CVE-2016-9363 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.3.

Another vulnerability found user-controlled input is not neutralized before being output to web page.

CVE-2016-9371 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 6.1.

In addition, requests are not verified to be intentionally submitted by the proper user.

CVE-2016-9365 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.8.

Meanwhile, an attacker can freely use brute force to determine parameters needed to bypass authentication.

CVE-2016-9366 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In addition, a configuration file contains parameters that represent passwords in plaintext.

CVE-2016-9348 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 3.3.

Finally, the amount of resources requested by a malicious actor is not restricted, leading to a denial-of-service caused by resource exhaustion.

CVE-2016-9367 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

No known public exploits specifically target these vulnerabilities. However, an attacker with low skill would be able to exploit these vulnerabilities.

Moxa released new firmware versions, which address the identified vulnerabilities in all but one of the affected NPort devices. Moxa recommends installing the new firmware version.

• NPort 5110 Version 2.6
• NPort 5130/5150 Series Version 3.6
• NPort 5200 Series Version 2.8
• NPort 5400 Series Version 3.11
• NPort 5600 Series Version 3.7
• NPort 5100A Series & NPort P5150A Version 1.3
• NPort 5200A Series Version 1.3
• NPort 5150AI-M12 Series Version 1.2
• NPort 5250AI-M12 Series Version 1.2
• NPort 5450AI-M12 Series Version 1.2
• NPort 5600-8-DT Series Version 2.4
• NPort 5600-8-DTL Series Version 1.3
• NPort 6×50 Series Version 1.14
• NPort IA5450A Version 1.4

Moxa reported the NPort 6110 device discontinued in December 2008 and will not have patches released to address these vulnerabilities. Moxa recommends users of the NPort 6110 should upgrade the affected device.



Leave a Reply

You must be logged in to post a comment.