CVE-2018-11426
📋 TL;DR
CVE-2018-11426 is an authentication bypass vulnerability in Moxa OnCell G3100-HSPA Series devices where weak cookie parameters allow attackers to brute force access to the web interface. This affects all functions except password change, potentially giving attackers full administrative control. Organizations using affected Moxa cellular gateways are vulnerable.
💻 Affected Systems
- Moxa OnCell G3100-HSPA Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the cellular gateway allowing attackers to reconfigure network settings, intercept traffic, disable security controls, and use the device as an entry point into internal networks.
Likely Case
Unauthorized access to the web interface enabling attackers to view configuration data, modify device settings, and potentially disrupt industrial operations that depend on these cellular gateways.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls, though the authentication bypass remains a serious vulnerability.
🎯 Exploit Status
The vulnerability involves brute forcing predictable cookie values, which is straightforward with automated tools. Public advisories include technical details that facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5 or later
Vendor Advisory: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3100-hspa-series-vulnerabilities
Restart Required: Yes
Instructions:
1. Download firmware version 1.5 or later from Moxa support portal. 2. Log into the web interface (if not compromised). 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload the new firmware file. 5. Wait for the device to reboot automatically.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to the web interface using firewall rules to only allow connections from trusted management networks.
Disable Unused Interfaces
allDisable any unnecessary network interfaces or services on the device to reduce attack surface.
🧯 If You Can't Patch
- Isolate affected devices in a separate network segment with strict firewall rules limiting inbound and outbound connections.
- Implement network monitoring and intrusion detection specifically for traffic to/from these devices to detect exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version via the web interface at System > System Information. If version is 1.4 Build 16062919 or earlier, the device is vulnerable.Check Version:
No CLI command available; must use web interface at System > System Information page.Verify Fix Applied:
After upgrading, verify the firmware version shows 1.5 or later in System > System Information. Test authentication by attempting to access the interface with invalid credentials.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful access without valid credentials
- Access from unusual IP addresses to administrative pages
Network Indicators:
- Brute force patterns to the web interface port (typically 80/443)
- Administrative access from unexpected network segments
SIEM Query:
source_ip=* dest_ip=[device_ip] dest_port=80 OR dest_port=443 (http_status=200 AND NOT user_agent contains "browser") OR (http_method=POST AND uri contains "login")