CVE-2018-11426

EUVD-2018-3457
A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
moxaoncell_g3150-hspa_firmware
𝑥
≤ 1.4
moxaoncell_g3150-hspa-t_firmware
𝑥
≤ 1.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-105.md
https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-105.md