As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.

Product support

Security Advisories

SUMMARY

OnCell G3150A-LTE Series Multiple Web Application Vulnerabilities and Security Enhancement

The OnCell G3150A-LTE Series prior to version 1.3 is affected by multiple web application vulnerabilities: CVE-2004-2761, CVE-2013-2566, CVE-2016-2183, CVE-2023-6093, and CVE-2023-6094. These vulnerabilities are caused by applying weak cryptographic algorithms and cipher suites, and incorrectly restricts frame objects. Successful exploitation of these vulnerabilities could lead to unauthorized access and unexpected user interaction with the web application. 

The identified vulnerability types and potential impacts are shown below:

Item Vulnerability Type Impact
1

Cryptographic Issues (CWE-310) 

CVE-2004-2761 

This vulnerability may make it easier for context-dependent attackers to conduct spoofing attacks. 
2

Inadequate Encryption Strength (CWE-326) 

CVE-2013-2566 

This vulnerability may make it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in numerous sessions that use the same plaintext. 
3

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) 

CVE-2016-2183 

This vulnerability may make it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session. 
4

Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (CWE-1021) 

CVE-2023-6093 

This vulnerability may lead the attacker to trick the user into interacting with the application. 
5

Cleartext Transmission of Sensitive Information (CWE-319) 

CVE-2023-6094 

This vulnerability may lead the attacker to gain access to user accounts and access sensitive data used by the user accounts. 

 

Vulnerability Scoring Details 

ID 

CVSS 

Vector 

Severity 

Remote Exploit without Auth? 

CVE-2004-2761 

5.0 

AV:N/AC:L/AU:N/C:N/I:P/A:N 

Medium 

Yes 

CVE-2013-2566 

5.9 

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 

Medium 

Yes 

CVE-2016-2183 

7.5 

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 

High 

Yes 

CVE-2023-6093 

5.3 

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N 

Medium 

Yes 

CVE-2023-6094 

5.3 

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 

Medium 

Yes 

AFFECTED PRODUCTS AND SOLUTIONS

Affected Products:

The affected products and firmware versions are shown below.

Product Series Affected Versions
OnCell G3150A-LTE Series  Firmware version v1.3 and prior versions 

 

Solutions:

Moxa has developed appropriate solutions to address the vulnerabilities (CVE-2004-2761, CVE-2013-2566, CVE-2016-2183), implementing the following security enhancements:  

  • Substitute weak cipher suites and algorithms with approved ones. 

Product Series Solutions
OnCell G3150A-LTE Series  Please contact Moxa Technical Support for the security patch.

Mitigation 

Since Oncell G3150A-LTE has been phased out, we don’t have any plans to address CVE 2023-6093 and CVE-2023-6094. We recommend that users follow the mitigation measures below to deploy the product in an appropriate product security context. 

Moxa recommends users to implement the following mitigations if necessary: 

  • Reduce network exposure by ensuring that all control system devices and systems are not accessible from the Internet. 

  • Place control system networks and remote devices behind firewalls, isolating them from business networks. 

  • When remote access is necessary, employ secure methods such as Virtual Private Networks (VPNs). It is important to note that VPNs may have vulnerabilities and should be kept up to date with the latest available version. Remember that the security of a VPN depends on the security of its connected devices. 

Revision History:

VERSION DESCRIPTION RELEASE DATE
1.0 First Release Dec 29, 2022

Relevant Products

OnCell G3150A-LTE Series ·

  •   Print this page
  • You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
Added To Bag
You have some items waiting in your bag; click here to finish your quote!
Feedback