Moxa Vulnerabilities Surge in ICS Devices

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) published an alert this week that highlighted vulnerabilities in Moxa’s MiiNePort devices, which are server modules that mainly operate in the manufacturing, energy and transportation sectors. Security researcher Karn Ganeshen warned that these models are plagued by at least three Moxa vulnerabilities.

What’s the Problem?

One flaw, CVE-2016-2286, can be thought of as weak credential management. The product is not protected by a password in its default configuration, which can let a remote attacker gain full administrative access. Ganeshen said that normal password hygiene should be enforced to mitigate this issue.

CVE-2016-2295 is a flaw that allows sensitive information such as passwords to be stored in cleartext inside the device’s configuration file. Attackers could remotely access this information if the recommended Transport Layer Security (TLS) encryption is not used to protect the data.

The last flaw, CVE-2016-2285, is a cross-site request forgery (CSRF) vulnerability. Using it, attackers could pretend to be users, changing passwords and configurations on the device.

ICS-CERT said Moxa will release a patch to address the vulnerabilities. Until that’s available, Moxa recommended disabling HTTP and Telenet ports as well as ensuring that all ports are only accessible by trusted systems. It also suggested users enable passwords.

It’s Bigger Than Moxa Vulnerabilities

Ganeshen has also analyzed the products of other ICS vendors and found vulnerabilities; it’s not just a Moxa problem.

“I feel ICS products are essentially waiting desperately to be exploited by threat actors,” Ganeshen told SecurityWeek. “While it is understood that these products cater to critical infrastructure and their continued availability and operations are essential, it is also important to be aware that these products do not always operate stand-alone, but rather are one component in the bigger solution.”

His point is well taken: Vulnerabilities in ICS products are amplified by the complexities of the overall systems to which they are connected.

Larry Loeb

Principal, PBC Enterprises

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

What’s the Problem?

It’s Bigger Than Moxa Vulnerabilities

More from

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

New proposed federal data privacy law suggests big changes

Topic updates