CVE-2016-9361
published 2017-02-13CVE-2016-9361: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
19.86%
97.1th percentile
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| moxa | nport_5100_series_firmware | <= 2.5 | — |
| moxa | nport_5100_series_firmware | <= 3.5 | — |
| moxa | nport_5100a_series_firmware | <= 1.2 | — |
| moxa | nport_5200_series_firmware | <= 2.7 | — |
| moxa | nport_5200a_series_firmware | <= 1.2 | — |
| moxa | nport_5400_series_firmware | <= 3.10 | — |
| moxa | nport_5600-8-dtl_series_firmware | <= 2.3 | — |
| moxa | nport_5600_series_firmware | <= 3.6 | — |
| moxa | nport_5x50a1-m12_series_firmware | <= 1.1 | — |
| moxa | nport_6100_series_firmware | <= 1.13 | — |
| moxa | nport_p5150a_series_firmware | <= 1.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
8-byte discovery packet over 4800/UDP
- →Detect unauthenticated credential retrieval attempts targeting Moxa devices by monitoring for Moxa protocol traffic on 4800/UDP, particularly discovery and credential-retrieval packets sent to broadcast (255.255.255.255) or directly to NPort/OnCell/MGate devices. ↗
- →Alert on Moxa UDP discovery traffic (8-byte payload to port 4800/UDP) as a precursor to CVE-2016-9361 credential retrieval exploitation; devices responding to this query may be vulnerable. ↗
- →Monitor for HTTP cookie-based exploit traffic targeting Moxa NPort 5110 devices, which can lead to an OOB Write, denial of availability, and data modification. ↗
- →Flag unauthenticated SNMP community string retrieval from Moxa devices as part of CVE-2016-9361 exploitation; admin credentials and SNMP read/read-write strings are exposed without authentication. ↗
- ·Vulnerability affects a wide range of Moxa NPort product lines; patched firmware versions vary per product line — ensure version checks are product-specific. ↗
- ·The Metasploit credential recovery module was validated on specific firmware versions; coverage may not extend to all affected product lines listed in the CVE. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Moxa NPort Password improper authentication (BID-85965 / ID 800798)
vuldb·2026-06-03·CVSS 9.8
CVE-2016-9361 [CRITICAL] Moxa NPort Password improper authentication (BID-85965 / ID 800798)
A vulnerability was found in Moxa NPort. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes improper authentication (Password).
This vulnerability appears as CVE-2016-9361. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
GHSA-www3-95vv-vgx8: An issue was discovered in Moxa NPort 5110 versions prior to 2
ghsa_unreviewed·2022-05-17
CVE-2016-9361 [CRITICAL] CWE-287 GHSA-www3-95vv-vgx8: An issue was discovered in Moxa NPort 5110 versions prior to 2
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating.
CISA ICS
Moxa NPort Device Vulnerabilities (Update A)
cisa_ics·2016-12-01
Moxa NPort Device Vulnerabilities (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Moxa NPort Device Vulnerabilities (Update A)
Last RevisedMarch 21, 2017
Alert CodeICSA-16-336-02A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSA-16-336-02 Moxa NPort Device Vulnerabilities that was published December 1, 2016, on the NCCIC/ICS-CERT web site.
Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp have identified vulnerabilities in Moxa’s NPort serial device servers. Moxa has produced new firmware versions to mitigate these vulnerabilities.
These vulnerabilities could be exploited remotely.
#
No detection rules found.
Metasploit
Moxa UDP Device Discovery
metasploit·CVSS 9.8
[CRITICAL] Moxa UDP Device Discovery
Moxa UDP Device Discovery
The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. A discovery packet compels a Moxa device to respond to the sender with some basic device information that is needed for more advanced functions. The discovery data is 8 bytes in length and is the most basic example of the Moxa protocol. It may be sent out as a broadcast (destination 255.255.255.255) or to an individual device. Devices that respond to this query may be vulnerable to serious information disclosure vulnerabilities, such as CVE-2016-9361. The module is the work of Patrick DeSantis of Cisco Talos and is derived from original work by K. Reid Wightman. Tested and validated o
Metasploit
Moxa Device Credential Retrieval
metasploit
Moxa Device Credential Retrieval
Moxa Device Credential Retrieval
The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. Many devices with firmware versions older than 2017 or late 2016 allow admin credentials and SNMP read and read/write community strings to be retrieved without authentication. This module is the work of Patrick DeSantis of Cisco Talos and K. Reid Wightman. Tested on: Moxa NPort 6250 firmware v1.13, MGate MB3170 firmware 2.5, and NPort 5110 firmware 2.6.
2017-02-13
Published