Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Moxa AWK-3131A AP lets attackers reuse login token

CVE-2016-8712 · published 9 years ago
Summary

The wireless access point’s web interface uses the same random value for every login attempt and only changes it after five minutes of inactivity. This makes it possible for an attacker to capture and reuse that value to gain unauthorized access to the device’s management functions. Update the firmware to a version that generates a fresh value for each session, or restrict web access to trusted users until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
moxa awk-3131a_firmware 1.1
cpe:2.3:o:moxa:awk-3131a_firmware:1.1:*:*:*:*:*:*:*
Original advisory text
An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one nonce for all session authentication req...
An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. The device uses one nonce for all session authentication requests and only changes the nonce if the web application has been idle for 300 seconds.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
1% chance of attack within 30 days
Type
CWE-613Insufficient Session Expiration
Timeline
Published13 Apr 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-8712 · NVD
Track software like this
Free during beta