CVE-2018-5453 Denial of service in Moxa OnCell G3100-HSPA Series
An attacker can cause the Moxa OnCell G3100-HSPA device to become unavailable by manipulating HTTP request length parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-5453?
CVE-2018-5453 is a high-severity denial of service vulnerability in Moxa OnCell G3100-HSPA Series, published on 5 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker may be able to edit the element of an HTTP request, causing the device to become unavailable.
Which versions are affected by CVE-2018-5453?
It affects 4 products.
Products include Moxa Oncell G3110-Hspa-T Firmware, Moxa Oncell G3110-Hspa Firmware, Moxa Oncell G3150-Hspa-T Firmware, Moxa Oncell G3150-Hspa Firmware.
How do I fix CVE-2018-5453?
No fix has been published for CVE-2018-5453 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-5453 being exploited?
There is no known exploitation of CVE-2018-5453 in the wild and no public exploit code.
Other vulnerabilities in Moxa OnCell G3100-HSPA Series
Sources
Also known as GHSA-f5fj-f6xf-9jxc.