Date: Mon, 02 May 2016 18:05:23 +0000
From: Karn Ganeshen <karnganeshen@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Moxa MiiNePort - Multiple Vulnerabilities

*Moxa MiiNePort - Multiple Vulnerabilities*


Multiple vulnerabilities are present in Moxa MiiNePort. Following versions
have been verified, but it is highly probable all other versions are
affected as well.


*About*


Moxa provides a full spectrum of quality products for industrial
networking, computing, and automation, and maintains a distribution and
service network that reaches customers in more than 70 countries. Our
products have connected over 30 million devices worldwide in a wide range
of applications, including factory automation, smart rail, smart grid,
intelligent transportation, oil & gas, marine, and mining. By continually
improving staff expertise in a variety of technologies and markets, we aim
to be the first choice for industrial automation solutions.


Moxa's embedded serial-to-Ethernet device server modules are small, consume
less power, and integration is easy.

The embedded serial-to-Ethernet device servers modules consist of the
MiiNePort serial device server series and the NE device server module
series.


Moxa’s MiiNePort E3 series embedded device servers are designed for
manufacturers who want to add sophisticated network connectivity to their
serial devices with minimal integration effort. The MiiNePort E3 is
empowered by the MiiNe, Moxa’s second generation SoC, which supports 10/100
Mbps Ethernet, up to 921.6 kbps serial baudrate, a versatile selection of
ready-to-use operation modes, and requires only a small amount of power. By
using Moxa’s innovative NetEZ technology, the MiiNePort E3 can be used to
convert any device with a standard serial interface to an Ethernet enabled
device in no time. In addition, the MiiNePort E3 is a compact embedded
device server with an RJ45 connector, making it easy to fit into virtually
any existing serial device.


http://www.moxa.com/product/MiiNePort_E1.htm

http://www.moxa.com/product/MiiNePort_E2.htm

http://www.moxa.com/product/MiiNePort_E3.htm



*Confirmed Device Models + Firmware versions*
Device name MiiNePort_E1_7080
Firmware version 1.1.10 Build 09120714

Device name MiiNePort_E1_4641
Firmware version 1.1.10 Build 09120714

Device name MiiNePort_E2_1242
Firmware version 1.1 Build 10080614

Device name : MiiNePort_E2_4561
Firmware version : 1.1 Build 10080614

Model name MiiNePort E3
Firmware version 1.0 Build 11071409


*Vulnerability Summary*

1. Weak Credentials Management - CVE-2016-2286

2. Sensitive information not protected - CVE-2016-2295

3. Vulnerable to Cross-Site Request Forgery - CVE-2016-2285


*Vulnerability Description*


1. *Weak Credentials Management*

By default, no password is set on the device / application. The device /
application does not enforce a mandatory password change mechanism, forcing
users to a) set/change the password on first login, b) ensure the password
meets complexity requirements, and c) change password periodically.

This allows anyone to access the device over HTTP and Telnet. Access to the
device provides full administrative functionality.

2. *Sensitive information not protected*

Information such as Connect passwords, SNMP community strings is not
protected and shown in clear-text when viewing and / or downloaded device
config (HTTP / Telnet).


3. Vulnerable to Cross-Site Request Forgery

There is no CSRF Token generated per page and / or per (sensitive)
function. Successful exploitation of this vulnerability allows silent
execution of unauthorized actions on the device such as password change,
configuration parameter changes, saving modified configuration, & device
reboot.

+++++
-- 
Best Regards,
Karn Ganeshen

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists