CVE-2018-5455
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Moxa OnCell G3100-HSPA Series cellular gateways by brute-forcing numeric-only cookie values. Attackers can gain unauthorized access to device functions and potentially control industrial equipment. Organizations using affected versions of these industrial cellular gateways are at risk.
💻 Affected Systems
- Moxa OnCell G3100-HSPA Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to manipulate industrial control systems, disrupt operations, or use the device as an entry point into industrial networks.
Likely Case
Unauthorized access to device configuration and management functions, potentially enabling network reconnaissance or device manipulation.
If Mitigated
Limited impact with proper network segmentation and access controls, though authentication bypass remains possible.
🎯 Exploit Status
The vulnerability is simple to exploit using automated tools to brute-force numeric cookie values. No authentication required to attempt exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5 or later
Vendor Advisory: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3100-hspa-series-vulnerabilities
Restart Required: Yes
Instructions:
1. Download firmware version 1.5 or later from Moxa website. 2. Log into device web interface. 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for upgrade to complete and device to reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate network segments with strict firewall rules
Access Control Lists
allRestrict access to device management interfaces to authorized IP addresses only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from critical systems
- Deploy network-based intrusion detection to monitor for authentication bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface: System > System Information > Firmware VersionCheck Version:
Not applicable - check via web interface or serial consoleVerify Fix Applied:
Verify firmware version is 1.5 or later and test authentication with invalid credentials📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login
- Unusual source IP addresses accessing device management interface
Network Indicators:
- HTTP requests with numeric-only cookie values
- Rapid authentication attempts to device web interface
SIEM Query:
source_ip=* AND (http_cookie=~"^[0-9]+$" OR (http_status=200 AND http_method=POST AND http_uri="/login.cgi"))