deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8367
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/94093; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02; http://www.securityfocus.com/bid/94093
CVE: CVE-2016-8368
Published: 2017-02-13
Description: An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. The affected Ethernet interface module is connected to a MELSEC-Q PLC, which may allow a remote attacker to connect to the PLC via Port 5002/TCP and cause a denial of service, requiring the PLC to be reset to resume operation. This is caused by an Unrestricted Externally Accessible Lock.
CVSS Score: 8.6 (HIGH)
CWE: CWE-662
References: http://www.securityfocus.com/bid/94632; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-03; http://www.securityfocus.com/bid/94632
CVE: CVE-2016-8369
Published: 2017-02-13
Description: An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request (CROSS-SITE REQUEST FORGERY).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94344; https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01; http://www.securityfocus.com/bid/94344
CVE: CVE-2016-8370
Published: 2017-02-13
Description: An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. Weakly encrypted passwords are transmitted to a MELSEC-Q PLC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://www.securityfocus.com/bid/94632; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-03; http://www.securityfocus.com/bid/94632
CVE: CVE-2016-8372
Published: 2017-02-13
Description: An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. A password is transmitted in a format that is not sufficiently secure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/93550; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05; http://www.securityfocus.com/bid/93550
CVE: CVE-2016-8374
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/94093; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02; http://www.securityfocus.com/bid/94093
CVE: CVE-2016-8376
Published: 2017-02-13
Description: An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. This non-validated redirect/non-validated forward (OPEN REDIRECT) allows chaining with authenticated vulnerabilities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/93547; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07; http://www.securityfocus.com/bid/93547
CVE: CVE-2016-8377
Published: 2017-02-13
Description: An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vulnerability exists when the software application connects to a malicious server, resulting in a stack buffer overflow. This causes an exploitable Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94938; https://ics-cert.us-cert.gov/advisories/ICSA-16-350-01; https://www.exploit-db.com/exploits/42700/
CVE: CVE-2016-8378
Published: 2017-02-13
Description: An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/94344; https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01; http://www.securityfocus.com/bid/94344
CVE: CVE-2016-8379
Published: 2017-02-13
Description: An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. Users are restricted to using short passwords.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/93550; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05; http://www.securityfocus.com/bid/93550
CVE: CVE-2016-8566
Published: 2017-02-13
Description: An issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a Recoverable Format, an authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/94552; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-01; http://www.securityfocus.com/bid/94552
CVE: CVE-2016-8567
Published: 2017-02-13
Description: An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database over Port 2638/TCP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/94549; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-01; http://www.securityfocus.com/bid/94549
CVE: CVE-2016-9332
Published: 2017-02-13
Description: An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94394; https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02; https://www.exploit-db.com/exploits/40779/
CVE: CVE-2016-9333
Published: 2017-02-13
Description: An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator's privilege through specially crafted input (SQL INJECTION).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/94394; https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02; http://www.securityfocus.com/bid/94394
CVE: CVE-2016-9334
Published: 2017-02-13
Description: An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. User credentials are sent to the web server in clear text, which may allow an attacker to discover the credentials if they are able to observe traffic between the web browser and the server.
CVSS Score: 7.3 (HIGH)
References: http://www.securityfocus.com/bid/95302; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06; http://www.securityfocus.com/bid/95302
CVE: CVE-2016-9337
Published: 2017-02-13
Description: An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus, a Command Injection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: http://www.securityfocus.com/bid/94697; https://ics-cert.us-cert.gov/advisories/ICSA-16-341-01; http://www.securityfocus.com/bid/94697
CVE: CVE-2016-9338
Published: 2017-02-13
Description: An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. Because of an Incorrect Permission Assignment for Critical Resource, users with administrator privileges may be able to remove all administrative users requiring a factory reset to restore ancillary web server function. Exploitation of this vulnerability will still allow the affected device to function in its capacity as a controller.
CVSS Score: 2.7 (LOW)
References: http://www.securityfocus.com/bid/95302; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06; http://www.securityfocus.com/bid/95302
CVE: CVE-2016-9339
Published: 2017-02-13
Description: An issue was discovered in INTERSCHALT Maritime Systems VDR G4e Versions 5.220 and prior. External input is used to construct paths to files and directories without properly neutralizing special elements within the pathname that could allow an attacker to read files on the system, a Path Traversal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/94776; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-04; http://www.securityfocus.com/bid/94776
CVE: CVE-2016-9343
Published: 2017-02-13
Description: An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware versions prior to FRN 16.00, which are not affected). By sending malformed common industrial protocol (CIP) packet, an attacker may be able to overflow a stack-based buffer and execute code on the controller or initiate a nonrecoverable fault resulting in a denial of service.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/95304; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-05; http://www.securityfocus.com/bid/95304
CVE: CVE-2016-9344
Published: 2017-02-13
Description: An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/94783; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-01; http://www.securityfocus.com/bid/94783
CVE: CVE-2016-9345
Published: 2017-02-13
Description: An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local attacker to elevate privileges within the DeltaV control system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/105767; http://www.securityfocus.com/bid/94584; https://ics-cert.us-cert.gov/advisories/ICSA-16-334-02
CVE: CVE-2016-9346
Published: 2017-02-13
Description: An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/94783; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-01; http://www.securityfocus.com/bid/94783
CVE: CVE-2016-9347
Published: 2017-02-13
Description: An issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X Simplex Wireless I/O Card V13.3. DeltaV Wireless I/O Cards (WIOC) running the firmware available in the DeltaV system, release v13.3, have the SSH (Secure Shell) functionality enabled unnecessarily.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/94586; https://ics-cert.us-cert.gov/advisories/ICSA-16-334-03; http://www.securityfocus.com/bid/94586
CVE: CVE-2016-9348
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  A configuration file contains parameters that represent passwords in plaintext.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9349
Published: 2017-02-13
Description: An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file system and extract files that can result in information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94629; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04; https://www.exploit-db.com/exploits/42401/
CVE: CVE-2016-9351
Published: 2017-02-13
Description: An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack a zip file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/94629; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04; https://www.exploit-db.com/exploits/42402/
CVE: CVE-2016-9353
Published: 2017-02-13
Description: An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94631; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04; http://www.securityfocus.com/bid/94631
CVE: CVE-2016-9354
Published: 2017-02-13
Description: An issue was discovered in Moxa DACenter Versions 1.4 and older. A specially crafted project file may cause the program to crash because of Uncontrolled Resource Consumption.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94891; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-02; http://www.securityfocus.com/bid/94891
CVE: CVE-2016-9356
Published: 2017-02-13
Description: An issue was discovered in Moxa DACenter Versions 1.4 and older. The application may suffer from an unquoted search path issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94891; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-02; http://www.securityfocus.com/bid/94891
CVE: CVE-2016-9357
Published: 2017-02-13
Description: An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/95817; https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01; http://www.securityfocus.com/bid/95817
CVE: CVE-2016-9360
Published: 2017-02-13
Description: An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has access to an authenticated session.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-522
References: http://www.securityfocus.com/bid/95630; http://www.securitytracker.com/id/1037809; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-05A
CVE: CVE-2016-9361
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  Administration passwords can be retried without authenticating.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9362
Published: 2017-02-13
Description: An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO [PII_REDACTED]. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/95074; https://ics-cert.us-cert.gov/advisories/ICSA-16-357-02; http://www.securityfocus.com/bid/95074
CVE: CVE-2016-9363
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  Buffer overflow vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9364
Published: 2017-02-13
Description: An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/95073; https://ics-cert.us-cert.gov/advisories/ICSA-16-357-01; http://www.securityfocus.com/bid/95073
CVE: CVE-2016-9365
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  Requests are not verified to be intentionally submitted by the proper user (CROSS-SITE REQUEST FORGERY).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9366
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  An attacker can freely use brute force to determine parameters needed to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965