CVE-2016-9361
📋 TL;DR
This vulnerability allows attackers to brute-force administrative passwords on affected Moxa NPort serial device servers without authentication. It affects multiple NPort series devices running outdated firmware versions. Attackers can gain administrative access to these industrial control system devices.
💻 Affected Systems
- Moxa NPort 5110
- NPort 5130/5150 Series
- NPort 5200 Series
- NPort 5400 Series
- NPort 5600 Series
- NPort 5100A Series
- NPort P5150A
- NPort 5200A Series
- NPort 5150AI-M12 Series
- NPort 5250AI-M12 Series
- NPort 5450AI-M12 Series
- NPort 5600-8-DT Series
- NPort 5600-8-DTL Series
- NPort 6x50 Series
- NPort IA5450A
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of industrial serial devices leading to disruption of industrial processes, data exfiltration, or lateral movement into OT networks.
Likely Case
Unauthorized administrative access to serial devices allowing configuration changes, service disruption, or credential harvesting.
If Mitigated
Limited impact if devices are isolated, have strong passwords, and network access controls prevent unauthorized connections.
🎯 Exploit Status
Simple brute-force attack against web interface. No authentication required to attempt password guesses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: See CVE description for specific version numbers per product series
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02
Restart Required: Yes
Instructions:
1. Download appropriate firmware update from Moxa website. 2. Backup device configuration. 3. Upload firmware via web interface or console. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate NPort devices in separate VLANs with strict firewall rules limiting access to authorized management stations only.
Strong Password Enforcement
allImplement complex, unique passwords for all administrative accounts and enable account lockout policies if supported.
🧯 If You Can't Patch
- Implement network access controls to restrict connections to NPort devices from trusted IP addresses only
- Monitor authentication logs for brute-force attempts and implement intrusion detection
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > System Info) or serial console, compare against patched versions in CVE descriptionCheck Version:
Via web interface or serial console: show version or system infoVerify Fix Applied:
Confirm firmware version matches or exceeds patched version, test that password retry attempts now require authentication📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from single source
- Successful logins from unexpected IP addresses
- Configuration changes without authorized change tickets
Network Indicators:
- HTTP POST requests to login.cgi with varying password parameters
- Unusual traffic patterns to NPort web interfaces
SIEM Query:
source_ip="NPort_IP" AND (event_type="authentication_failure" COUNT > 10 WITHIN 5min) OR (event_type="configuration_change" AND user NOT IN authorized_users)