CVE-2016-2285

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources

Severity

8.8HIGH

EPSS

0.2%

top 58.52%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Moxa Miineport E1 4641 Firmware Moxa Miineport E1 7080 Firmware Moxa Miineport E2 1242 Firmware +2 more

Timeline

PublishedMay 31

Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allows remote attackers to hijack the authentication of arbitrary users.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶NVDmoxa/miineport_e3_firmware1.0

▶NVDmoxa/miineport_e1_4641_firmware1.1.10

▶NVDmoxa/miineport_e1_7080_firmware1.1.10

▶NVDmoxa/miineport_e2_1242_firmware1.1

▶NVDmoxa/miineport_e2_4561_firmware1.1

🔴Vulnerability Details

GHSA

GHSA-3c8m-2jhw-v237: Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1↗2022-05-17

▶

CVEList

CVE-2016-2285: Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1↗2016-05-31

▶