8.8

CVE-2016-2285

Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allows remote attackers to hijack the authentication of arbitrary users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moxa ≫ Miineport E2 1242 Firmware Version 1.1
   Moxa ≫ Miineport E2 1242 Version -
Moxa ≫ Miineport E2 4561 Firmware Version 1.1
   Moxa ≫ Miineport E2 4561 Version -
Moxa ≫ Miineport E1 7080 Firmware Version 1.1.10
   Moxa ≫ Miineport E1 7080 Version -
Moxa ≫ Miineport E3 Firmware Version 1.0
   Moxa ≫ Miineport E3 Version -
Moxa ≫ Miineport E1 4641 Firmware Version 1.1.10
   Moxa ≫ Miineport E1 4641 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.436
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://seclists.org/fulldisclosure/2016/May/7
https://ics-cert.us-cert.gov/advisories/ICSA-16-145-01
Third Party Advisory
US Government Resource