OnCell G3150A-LTE Series Multiple Web Application Vulnerabilities and Security Enhancement

Moxa Security Advisory

The OnCell G3150A-LTE Series prior to version 1.3 is affected by multiple web application vulnerabilities: CVE-2004-2761, CVE-2013-2566, CVE-2016-2183, CVE-2023-6093, and CVE-2023-6094. These vulnerabilities are caused by applying weak cryptographic algorithms and cipher suites, and incorrectly restricts frame objects. Successful exploitation of these vulnerabilities could lead to unauthorized access and unexpected user interaction with the web application. 

The identified vulnerability types and potential impacts are shown below:

Item
Vulnerability Type
Impact

1

Cryptographic Issues (CWE-310) 

CVE-2004-2761 

This vulnerability may make it easier for context-dependent attackers to conduct spoofing attacks. 

2

Inadequate Encryption Strength (CWE-326) 

CVE-2013-2566 

This vulnerability may make it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in numerous sessions that use the same plaintext. 

3

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) 

CVE-2016-2183 

This vulnerability may make it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session. 

4

Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (CWE-1021) 

CVE-2023-6093 

This vulnerability may lead the attacker to trick the user into interacting with the application. 

5

Cleartext Transmission of Sensitive Information (CWE-319) 

CVE-2023-6094 

This vulnerability may lead the attacker to gain access to user accounts and access sensitive data used by the user accounts. 

 

Vulnerability Scoring Details 

ID 

CVSS 

Vector 

Severity 

Remote Exploit without Auth? 

CVE-2004-2761 

5.0 

AV:N/AC:L/AU:N/C:N/I:P/A:N 

Medium 

Yes 

CVE-2013-2566 

5.9 

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 

Medium 

Yes 

CVE-2016-2183 

7.5 

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 

High 

Yes 

CVE-2023-6093 

5.3 

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N 

Medium 

Yes 

CVE-2023-6094 

5.3 

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 

Medium 

Yes 

READ MORE