Full Report
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software.
Analysis Summary
# Vulnerability: User Enumeration in Moxa ThingsPro Gateway
## CVE Details
- **CVE ID:** CVE-2018-18390
- **CVSS Score:** 5.3 (Medium)
* *Note: While the provided text lists a base score of 0.0, the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N actually calculates to 5.3 according to standard CVSS v3.x calculators.*
- **CWE:** CWE-204 (Observable Response Discrepancy / User Enumeration)
## Affected Systems
- **Products:** Moxa ThingsPro IIoT Gateway and Device Management Software
- **Versions:** ThingsPro version 2.1
- **Configurations:** Default web application login interface.
## Vulnerability Description
A user enumeration vulnerability exists in the web application component of Moxa ThingsPro. The application provides different responses to login attempts depending on whether a username is valid or invalid. This discrepancy allows a remote, unauthenticated attacker to verify the existence of specific user accounts on the system.
## Exploitation
- **Status:** Unknown (No public PoC cited in the advisory, but the flaw is trivial to verify).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Discovery of valid system usernames).
- **Integrity:** None
- **Availability:** None
- *Secondary Risk:* Successful enumeration significantly facilitates brute-force or dictionary attacks against the identified accounts.
## Remediation
### Patches
- **ThingsPro Gateway Edition 2.3:** Moxa has addressed this vulnerability in version 2.3. Users are advised to contact their Moxa sales representative or technical support to obtain the updated firmware.
### Workarounds
- **Strict Password Policies:** Implement strong password requirements to mitigate the risk of subsequent brute-force attacks:
- Minimum length of 8 characters.
- Inclusion of digits (0-9).
- Mixture of uppercase and lowercase letters (A-Z, a-z).
- Inclusion of special characters (~, !, @, #, $, %, etc.).
## Detection
- **Indicators of Compromise:** High volumes of failed login attempts from a single IP address with varying usernames.
- **Detection Methods:** Monitor web server logs for HTTP 401/403 responses or login submission patterns that suggest automated probing of the authentication endpoint.
## References
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2018/10/18/klcert-18-018-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-user-enumeration/
- **NVD CVE Details:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2018-18390
- **CVSS Calculator:** hxxps[://]www[.]first[.]org/cvss/calculator/3.1#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N