CVE-2016-0879
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.22% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- moxa/edr-g903 firmware
- Source
- ics-cert@hq.dhs.gov
References
- https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.