CVE-2016-9367
published 2017-02-13CVE-2016-9367: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.69%
74.4th percentile
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. The amount of resources requested by a malicious actor is not restricted, leading to a denial-of-service caused by resource exhaustion.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| moxa | nport_5100_series_firmware | <= 2.5 | — |
| moxa | nport_5100_series_firmware | <= 3.5 | — |
| moxa | nport_5100a_series_firmware | <= 1.2 | — |
| moxa | nport_5200_series_firmware | <= 2.7 | — |
| moxa | nport_5200a_series_firmware | <= 1.2 | — |
| moxa | nport_5400_series_firmware | <= 3.10 | — |
| moxa | nport_5600-8-dtl_series_firmware | <= 2.3 | — |
| moxa | nport_5600_series_firmware | <= 3.6 | — |
| moxa | nport_5x50a1-m12_series_firmware | <= 1.1 | — |
| moxa | nport_6100_series_firmware | <= 1.13 | — |
| moxa | nport_p5150a_series_firmware | <= 1.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Moxa NPort resource consumption (BID-85965 / ID 800798)
vuldb·2026-06-03·CVSS 7.5
CVE-2016-9367 [HIGH] Moxa NPort resource consumption (BID-85965 / ID 800798)
A vulnerability marked as problematic has been reported in Moxa NPort. This impacts an unknown function. This manipulation causes resource consumption.
The identification of this vulnerability is CVE-2016-9367. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
GHSA-jqp8-2gqc-3mch: An issue was discovered in Moxa NPort 5110 versions prior to 2
ghsa_unreviewed·2022-05-17
CVE-2016-9367 [HIGH] CWE-400 GHSA-jqp8-2gqc-3mch: An issue was discovered in Moxa NPort 5110 versions prior to 2
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. The amount of resources requested by a malicious actor is not restricted, leading to a denial-of-service caused by resource exhaustion.
CISA ICS
Moxa NPort Device Vulnerabilities (Update A)
cisa_ics·2016-12-01
Moxa NPort Device Vulnerabilities (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Moxa NPort Device Vulnerabilities (Update A)
Last RevisedMarch 21, 2017
Alert CodeICSA-16-336-02A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSA-16-336-02 Moxa NPort Device Vulnerabilities that was published December 1, 2016, on the NCCIC/ICS-CERT web site.
Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp have identified vulnerabilities in Moxa’s NPort serial device servers. Moxa has produced new firmware versions to mitigate these vulnerabilities.
These vulnerabilities could be exploited remotely.
#
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-02-13
Published