Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Moxa OnCell G3100 devices allow cookie brute-force login

CVE-2018-5455 · published 8 years ago
Summary

The firmware on the listed Moxa OnCell G3100‑HSPA models accepts a numeric cookie without checking its validity, letting an attacker guess the value and skip the login step. This could give unauthorized users access to the device’s controls. Update the device firmware to the latest version and ensure strong authentication settings are in place.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
moxa oncell_g3110-hspa_firmware <= 1.4
cpe:2.3:o:moxa:oncell_g3110-hspa_firmware:*:*:*:*:*:*:*:*
moxa oncell_g3110-hspa-t_firmware <= 1.4
cpe:2.3:o:moxa:oncell_g3110-hspa-t_firmware:*:*:*:*:*:*:*:*
moxa oncell_g3150-hspa_firmware <= 1.4
cpe:2.3:o:moxa:oncell_g3150-hspa_firmware:*:*:*:*:*:*:*:*
moxa oncell_g3150-hspa-t_firmware <= 1.4
cpe:2.3:o:moxa:oncell_g3150-hspa-t_firmware:*:*:*:*:*:*:*:*
Original advisory text
A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter...
A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing authentication and gaining access to device functions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-565Reliance on Cookies without Validation and Integrity Checking
CWE-287Improper Authentication
Timeline
Published5 Mar 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-5455 · NVD
Track software like this
Free during beta