CVE-2017-16727 Hardcoded credentials in Moxa NPort W2150A and W2250A
An attacker can access the device without a password due to an empty default credential, compromising wireless traffic confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16727?
CVE-2017-16727 is a critical vulnerability in Moxa NPort W2150A and W2250A, published on 22 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely compromise the confidentiality and integrity of the wireless traffic.
Which versions are affected by CVE-2017-16727?
It affects 2 products.
Products include Moxa Nport W2150a Firmware, Moxa Nport W2250a Firmware.
How do I fix CVE-2017-16727?
No fix has been published for CVE-2017-16727 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-16727 being exploited?
There is no known exploitation of CVE-2017-16727 in the wild and no public exploit code.
Sources
Also known as GHSA-8vv3-5rrp-vm83.