Login
Sign-up
AboutIT4A
SHOPOT Products
SUPPLYSolutions
HOSTSolutions
PROTECTSolutions
CONNECTServices
UsefulRESOURCES
CONTACTIT4A

OnCell G3150A-LTE Series Multiple Web Application Vulnerabilities and Security Enhancement

Published: December 29, 2023

This Alert Is From MOXA

As Industrial IoT (IIoT) adoption continues to proliferate, cybersecurity has become one of the top priorities. The Moxa Product Security Incident Response Team (PSIRT) takes a proactive approach to protect products from cybersecurity vulnerabilities. Moxa PSIRT investigates all reports of vulnerabilities that could potentially affect Moxa products. Moxa created a vulnerability management policy to provide guidance and information to our customers in the event of a reported vulnerability. The management policy ensures that Moxa’s customers have steady, unambiguous resources to help them understand how Moxa resolves or mitigates reported vulnerabilities. For any queries, please email [email protected].

The OnCell G3150A-LTE Series prior to version 1.3 is affected by multiple web application vulnerabilities: CVE-2004-2761, CVE-2013-2566, CVE-2016-2183, CVE-2023-6093, and CVE-2023-6094. These vulnerabilities are caused by applying weak cryptographic algorithms and cipher suites, and incorrectly restricts frame objects. Successful exploitation of these vulnerabilities could lead to unauthorized access and unexpected user interaction with the web application. 

The identified vulnerability types and potential impacts are shown below:

Item Vulnerability Type Impact
1

Cryptographic Issues (CWE-310) 

CVE-2004-2761 

 This vulnerability may make it easier for context-dependent attackers to conduct spoofing attacks. 
2

Inadequate Encryption Strength (CWE-326) 

CVE-2013-2566 

 This vulnerability may make it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in numerous sessions that use the same plaintext. 
3

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) 

CVE-2016-2183 

 This vulnerability may make it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session. 
4

Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (CWE-1021) 

CVE-2023-6093 

 This vulnerability may lead the attacker to trick the user into interacting with the application. 
5

Cleartext Transmission of Sensitive Information (CWE-319) 

CVE-2023-6094 

 This vulnerability may lead the attacker to gain access to user accounts and access sensitive data used by the user accounts. 

 

Vulnerability Scoring Details 

ID 

CVSS 

Vector 

Severity 

Remote Exploit without Auth? 

CVE-2004-2761 

5.0 

AV:N/AC:L/AU:N/C:N/I:P/A:N 

Medium 

Yes 

CVE-2013-2566 

5.9 

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 

Medium 

Yes 

CVE-2016-2183 

7.5 

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 

High 

Yes 

CVE-2023-6093 

5.3 

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N 

Medium 

Yes 

CVE-2023-6094 

5.3 

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 

Medium 

Yes 

 

This alert has come from: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement