CVE-2016-5799
📋 TL;DR
This vulnerability allows remote attackers to perform brute-force attacks against Moxa OnCell cellular gateway devices due to insufficient authentication attempt restrictions. Successful exploitation grants unauthorized access to device administration interfaces. Affected organizations include industrial control systems, utilities, and remote infrastructure using these specific Moxa devices.
💻 Affected Systems
- Moxa OnCell G3100V2
- Moxa OnCell G3111
- Moxa OnCell G3151
- Moxa OnCell G3211
- Moxa OnCell G3251
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to reconfigure industrial networks, disrupt operations, or pivot to internal systems.
Likely Case
Unauthorized administrative access leading to device configuration changes, network disruption, or credential theft.
If Mitigated
Limited impact with proper network segmentation and monitoring detecting brute-force attempts.
🎯 Exploit Status
Brute-force attacks require no special tools or authentication. Attackers only need network access to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: G3100V2 2.8 or later; G3111, G3151, G3211, G3251 1.7 or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01
Restart Required: Yes
Instructions:
1. Download firmware from Moxa support portal. 2. Backup device configuration. 3. Upload firmware via web interface. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to device management interfaces using firewall rules.
Account Lockout Implementation
allConfigure external authentication system with account lockout policies.
🧯 If You Can't Patch
- Implement network segmentation to isolate devices from untrusted networks
- Deploy intrusion detection systems to monitor for brute-force attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console.Check Version:
Login to web interface and check System Information page.Verify Fix Applied:
Confirm firmware version is G3100V2 2.8+ or other models 1.7+.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from single IP
- Successful login after many failures
Network Indicators:
- High volume of HTTP/HTTPS requests to login endpoints
- Traffic patterns suggesting automated credential testing
SIEM Query:
source_ip=* AND (url_path="/login" OR url_path="/cgi-bin/login.cgi") AND status=401 COUNT > 10 PER hour