Surveillance solutions from Moxa and Vanderbilt firms affected by flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-9333 | An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator's privilege through specially crafted input (SQL INJECTION). NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2016-9155 | The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances. NVD description · AI analysis pending | 9.8 | 2% |
| — |
Full article403 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 20, 2016
The ICS-CERT has published two security advisories to describe a number of flaws in surveillance products from Moxa and Vanderbilt firms.
Surveillance systems produced by Moxa SoftCMS and IP cameras manufactured by Vanderbilt are affected by serious vulnerabilities that can be exploited by remote attackers to obtain full control of flawed systems.
The ICS-CERT has published a security advisory to describe three serious vulnerabilities in the central management software Moxa SoftCMS Webserver Application.
Zhou Yu working with Trend Micro’s Zero Day Initiative and Gu Ziqiang from Huawei Weiran Labs been credited for finding the security vulnerabilities in the Moxa SoftCMS.
One of the flaw was rated with a 9.8 CVSS score, it is a SQL injection flaw tracked as CVE-2016-9333 that can be exploited by a remote attacker to access SoftCMS with administrator privileges.
“The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator’s privilege through specially crafted input.” reads the advisory.
A second vulnerability, tracked as CVE-2016-8360, is a double free condition that could be exploited to cause a denial-of-service (DoS) and in some cases even execute arbitrary code.
“A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.” continues the advisory.
The third vulnerability, tracked as CVE-2016-9332, is an improper input validation issue that can lead to a crash of the application.
“Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition.” states the advisory.
According to the ICS-CERT, Moxa fixed all the vulnerabilities in the latest SoftCMS 1.6 release, but the release notes suggest that only the SQL Injection has been fixed.
Similar problems also for the CCTV IP cameras manufactured by Vanderbilt.
According to the ICS-CERT, a vulnerability (CVE-2016-9155) in the IP cameras could be exploited by attackers with network access to obtain administrative credentials using specially crafted requests.
“An attacker with network access to the web server could obtain administrative credentials by sending certain requests.” reads the ICS-CERT advisory.
Vanderbilt has already released security updates for all the affected products.
[adrotate banner=”9″]
(Security Affairs – Moxa SoftCMS, Vanderbilt)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/53600/hacking/moxa-vanderbilt-flaws.html