Information disclosure in Moxa Miineport E1
CVE-2016-9344
An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.016 (75.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Moxa Miineport E1
- Moxa Miineport E1 Firmware
- Moxa Miineport E2
- Moxa Miineport E2 Firmware
- Moxa Miineport E3
- Moxa Miineport E3 Firmware
- Moxa Miineport — versions Moxa MiiNePort
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSA-16-343-01 (US Government Resource, Third Party Advisory)
- www.securityfocus.com/bid/94783 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2016-9344?
- CVE-2016-9344 is a high-severity vulnerability in Moxa Miineport E1, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.5/10. Published 2017-02-13.
- How severe is CVE-2016-9344?
- High severity. CVSS v3 base score is 7.5 out of 10.