CVE-2017-7913
📋 TL;DR
This vulnerability allows attackers to read passwords stored in plaintext within configuration files of affected Moxa OnCell cellular gateway devices. Anyone with access to the device's file system can extract credentials, potentially compromising the entire device and connected systems. Affected users include organizations using these specific Moxa cellular gateways for industrial control systems.
💻 Affected Systems
- Moxa OnCell G3110-HSPA
- Moxa OnCell G3110-HSDPA
- Moxa OnCell G3150-HSDPA
- Moxa OnCell 5104-HSDPA
- Moxa OnCell 5104-HSPA
- Moxa OnCell 5004-HSPA
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the device, pivot to connected industrial control systems, and cause physical damage or operational disruption.
Likely Case
Attackers extract credentials to gain unauthorized access to the device, potentially modifying configurations or using it as a foothold into the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the compromised device only.
🎯 Exploit Status
Exploitation requires file system access, which typically requires some level of authentication, but the vulnerability itself is simple to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Moxa for updated firmware versions
Vendor Advisory: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3110-g3150-5104-5004-plaintext-password-vulnerability
Restart Required: Yes
Instructions:
1. Contact Moxa support for updated firmware. 2. Backup current configuration. 3. Apply firmware update via web interface or console. 4. Restart device. 5. Verify passwords are now encrypted in configuration files.
🔧 Temporary Workarounds
Restrict Configuration File Access
allLimit access to device configuration files through proper file permissions and access controls.
Network Segmentation
allIsolate affected devices in separate network segments with strict firewall rules.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can connect to these devices
- Regularly rotate passwords and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Examine configuration files on the device for plaintext password entries. Check web interface or console for firmware version.Check Version:
Check via web interface under System > Firmware Version or via console using 'show version' commandVerify Fix Applied:
After patching, verify that configuration files no longer contain plaintext passwords and that passwords appear encrypted or hashed.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to configuration files
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual network traffic from device
- Connections to unexpected external IP addresses
SIEM Query:
source="moxa-oncell" AND (event="config_access" OR event="failed_login")