CVE-2018-11422

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2019-07-03

Last modified

2024-08-05

Weaknesses

CWE-319

Affected products

• Oncell G3150-hspa-t Firmware (Moxa)
• Oncell G3150-hspa Firmware (Moxa)

References

• https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md