CVE-2017-7917: CSRF
A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell 5104-HSPA, and OnCell 5004-HSPA. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request, which could allow an attacker to modify the configuration of the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7917?
CVE-2017-7917 is classified as a medium-severity vulnerability due to its potential impact on security through Cross-Site Request Forgery.
How do I fix CVE-2017-7917?
To mitigate CVE-2017-7917, update the Moxa OnCell device firmware to a version that is not vulnerable, specifically versions higher than 1.3 for G3110-HSPA, higher than 1.2 for G3110-HSDPA, and higher than 1.4 for G3150-HSDPA.
Which Moxa devices are affected by CVE-2017-7917?
CVE-2017-7917 affects the Moxa OnCell G3110-HSPA, G3110-HSDPA, G3150-HSDPA, and OnCell 5104 models running specified vulnerable firmware versions.
What type of vulnerability is CVE-2017-7917?
CVE-2017-7917 is a Cross-Site Request Forgery (CSRF) vulnerability, which could allow an attacker to perform unauthorized actions on behalf of a user.
Are there any workarounds for CVE-2017-7917 if an update cannot be applied?
While it's recommended to apply firmware updates, if not possible, limiting access to the device and employing network security measures can help mitigate the risk from CVE-2017-7917.