ID

VAR-201702-0860

CVE

CVE-2016-9361

TITLE

plural Moxa NPort Vulnerability in product management passwords being retried without authentication

DESCRIPTION

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating. MOXANport is a serial communication server. MoxaNPort has a credential management vulnerability. An unauthenticated attacker exploits the vulnerability to obtain an administrator password. Multiple Moxa NPort products are prone to multiple unspecified security vulnerabilities. An attacker can exploit these issues to bypass security restrictions, perform unauthorized actions, gain escalated privileges and execute arbitrary code in the context of the affected application and cause a denial-of-service condition. Successful exploitation will allow an attacker to take control of the affected system. ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Auxiliary::Report include Msf::Auxiliary::UDPScanner def initialize(info = {}) super( update_info( info, 'Name' => 'Moxa UDP Device Discovery', 'Description' => %q( The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. A discovery packet compels a Moxa device to respond to the sender with some basic device information that is needed for more advanced functions. The discovery data is 8 bytes in length and is the most basic example of the Moxa protocol. It may be sent out as a broadcast (destination 255.255.255.255) or to an individual device. Devices that respond to this query may be vulnerable to serious information disclosure vulnerabilities, such as CVE-2016-9361. The module is the work of Patrick DeSantis of Cisco Talos and is derived from original work by K. Reid Wightman. Tested and validated on a Moxa NPort 6250 with firmware versions 1.13 and 1.15. ), 'Author' => 'Patrick DeSantis <p[at]t-r10t.com>', 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2016-9361'], [ 'URL', 'https://www.digitalbond.com/blog/2016/10/25/serial-killers/'], [ 'URL', 'http://www.moxa.com/support/faq/faq_detail.aspx?id=646' ], ] ) ) register_options( [ # Moxa protocol listens on 4800/UDP by default Opt::RPORT(4800) ]) end # The data to be sent via UDP def build_probe # Function Code (first byte) 0x01: Moxa discovery/identify # The fourth byte is the length of the full data payload @probe ||= "\x01\x00\x00\x08\x00\x00\x00\x00" end # Called for each response packet def scanner_process(response, src_host, _src_port) # The first byte of a response will always be the func code + 0x80 # (the most significant bit of the byte is set to 1, so 0b00000001 # becomes 0b10000001, or 0x81). # A valid response is 24 bytes, starts with 0x81, and contains the values # 0x00, 0x90, 0xe8 (the Moxa OIU) in bytes 14, 15, and 16. return unless response[0] == "\x81" && response[14..16] == "\x00\x90\xe8" && response.length == 24 @results[src_host] ||= [] @results[src_host] << response end # Called after the scan block def scanner_postscan(_batch) @results.each_pair do |host, response| peer = "#{host}:#{rport}" # Report the host report_host( :host => host, :info => "Moxa Device", ) # Report the service report_service( host: host, proto: 'udp', port: rport, name: 'Moxa Protocol', ) if response.empty? vprint_status("#{peer} No Moxa Devices Found.") else print_good("#{peer} Moxa Device Found!") # Report vuln report_vuln( host: host, port: rport, proto: 'udp', name: 'Moxa Protocol Use', refs: references ) end end end end

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

authorization issue

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Reid Wightman of Digital Bonds Labs

SOURCES

LAST UPDATE DATE

2024-09-03T23:02:33.588000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE