Moxa Updates NPort Fix

Wednesday, March 22, 2017 @ 12:03 PM gHale


Moxa updated a vulnerability with its NPort Device where the company listed the versions affected by the issue that received new firmware versions, according to a report with ICS-CERT.

Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp discovered the remotely exploitable vulnerabilities in the NPort serial device servers.

RELATED STORIES
Rockwell Fixes FactoryTalk Hole
Rockwell Clears Workbench Vulnerability
LCDS Fixes SCADA Software
Design Flaws in Accelerometer Hardware
Fatek Clears PLC Ethernet Module Hole

Moxa said the vulnerability affects the following versions of NPort:
• NPort 5110 versions prior to 2.7
• NPort 5130/5150 Series versions prior to 3.7
• NPort 5200 Series versions prior to 2.9
• NPort 5400 Series versions prior to 3.12
• NPort 5600 Series versions prior to 3.8
• NPort 5100A Series & NPort P5150A versions prior to 1.4
• NPort 5200A Series versions prior to 1.4
• NPort 5150AI-M12 Series versions prior to 1.3
• NPort 5250AI-M12 Series versions prior to 1.3
• NPort 5450AI-M12 Series versions prior to 1.3
• NPort 5600-8-DT Series versions prior to 2.5
• NPort 5600-8-DTL Series versions prior to 2.5
• NPort IA5450A versions prior to v1.4
• NPort 6000 series versions prior to 1.16
• NPort 6110 series all versions

Successful exploitation of these vulnerabilities could lead to the complete compromise of an affected system.

Moxa is a Taiwan-based company that maintains offices in several countries around the world, including the U.S., UK, India, Germany, France, China, Russia, and Brazil.

The affected products, NPort devices, connect serial devices to Ethernet networks. NPort devices see use across several sectors including critical manufacturing, energy, and transportation systems. Moxa estimates these products see action on a global basis.

In the credential management issue, administration passwords can be retried without authenticating.

CVE-2016-9361 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In addition, firmware can end up updated over the network without authentication, which may allow remote code execution.

CVE-2016-9369 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

A buffer overflow vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code.

CVE-2016-9363 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.3.

In a cross-site scripting vulnerability, user-controlled input does not end up neutralized before being output to web page.

CVE-2016-9371 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 6.1.

In a cross-site request forgery issue, requests do not end up verified to be intentionally submitted by the proper user.

CVE-2016-9365 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.8.

In the improper restriction of excessive authentication attempts vulnerability, an attacker can freely use brute force to determine parameters needed to bypass authentication.

CVE-2016-9366 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

In a plain text storage of a password vulnerability, a configuration file contains parameters that represent passwords in plaintext.

CVE-2016-9348 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 3.3.

In a resource exhaustion issue, the amount of resources requested by a malicious actor does not end up restricted, leading to a denial-of-service caused by resource exhaustion.

CVE-2016-9367 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

No known public exploits specifically target these vulnerabilities. However, an attacker with low skill would be able to exploit these vulnerabilities.

Moxa released new firmware versions, which address the identified vulnerabilities in all but one of the affected NPort devices. Moxa recommends installing the new firmware version.
• NPort 5110 Version 2.7
• NPort 5130/5150 Series Version 3.7
• NPort 5200 Series Version 2.9
• NPort 5400 Series Version 3.12
• NPort 5600 Series Version 3.8
• NPort 5100A Series & NPort P5150A Version 1.4
• NPort 5200A Series Version 1.4
• NPort 5150AI-M12 Series Version 1.3
• NPort 5250AI-M12 Series Version 1.3
• NPort 5450AI-M12 Series Version 1.3
• NPort 5600-8-DT Series Version 2.5
• NPort 5600-8-DTL Series Version 1.4
• NPort IA5450A Version 1.4
• NPort 6000 Series Version 1.16

Moxa said they discontinued the NPort 6110 device in December 2008 and will not have patches released to address these vulnerabilities. Moxa recommends that customers using the NPort 6110 should upgrade the affected device.



Leave a Reply

You must be logged in to post a comment.