CVE-2016-8362

moderate-risk
Published 2017-02-13

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. Any user is able to download log files by accessing a specific URL.

Do I need to act?

-
0.16% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (14)

Awk-4131A Firmware
Awk-5232 Firmware
Awk-1121 Firmware
Wac-2004 Firmware
Awk-1131A Firmware
Oncellg3470A-Lte Firmware
Awk-3191 Firmware
Awk-6232 Firmware
Awk-1127 Firmware
Wac-1001 V2 Firmware
Awk-3121-M12-Rtg Firmware
Awk-3131-M12-Rcc Firmware
Awk-5232-M12-Rcc Firmware

Affected Vendors

Moxa

References (4)

Third Party Advisory http://www.securityfocus.com/bid/94092
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-308-01
Third Party Advisory http://www.securityfocus.com/bid/94092
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-308-01
43
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 18/34 · Moderate