Moxa Oncell g3150-Hspa-T Firmware vulnerabilities

9 CVEs affecting Moxa Oncell g3150-Hspa-T Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11423, published 2019-07-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11426, published 2019-07-03. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication…
CVE-2018-5455, published 2018-03-05. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter…
CVE-2018-11420, published 2019-07-03. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-11423.
CVE-2018-11423, published 2019-07-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420.
CVE-2018-5453, published 2018-03-05. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker may be able to edit the element of an…
CVE-2018-11422, published 2019-07-03. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All…
CVE-2018-11421, published 2019-07-03. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All…
CVE-2018-11427, published 2019-07-03. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF attacks on the device administrator.
CVE-2018-5449, published 2018-03-05. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does not check for a NULL value, allowing for an attacker to…