CVE-2016-8362
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. Any user is able to download log files by accessing a specific URL.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThis is an information disclosure vulnerability where the Moxa wireless device firmware allows any authenticated user to download log files via a specific URL. The application fails to properly restrict access to log files, meaning even low-privilege users can access sensitive system logs that may contain configuration details, connection history, or debugging information.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 10-31-2016<= 10-31-2016<= 05-30-2017<= 05-30-2017<= 05-30-2017<= 06-29-2017<= 06-29-2017<= 06-29-2017CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Moxa device model and firmware versionAccess the device web interface or use SNMP to retrieve the exact model number and firmware version. Compare against the affected product list and version dates.Affected if Device model matches any affected product (Oncellg3470a, Awk 4131a, Awk 3191, Awk 5232, Awk 6232, Awk 1121, Awk 1127, Wac 1001 V2) AND firmware version date is on or before the listed vulnerability release date.
-
Verify low-privilege user accounts existLog into the device administration interface and check user accounts. Create a test non-administrator user if one does not exist, or use an existing low-privilege account.Affected if Non-administrative or read-only user accounts are configured on the device.
-
Test log file download URL access with low-privilege userLog in with a low-privilege (non-admin) user account and attempt to access the log file download endpoint. Common endpoints include /log, /logs, /download_log, or similar paths that return system logs.Affected if Low-privilege user can successfully download log files via the web interface without receiving an access denied error.
-
Inspect downloaded log contents for sensitive dataOpen the downloaded log file and examine whether it contains configuration details, connection history, debugging information, or other sensitive system data that should be restricted.Affected if Log files contain sensitive information such as credentials, network configuration, debug output, or system event details accessible to low-privilege users.
Device is affected if it is a listed Moxa model with firmware dated on or before the vulnerability release date AND low-privilege users can access and download system log files.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImplement proper role-based access control (RBAC) to ensure only administrative users can access log files. If available, apply vendor firmware updates that address this authorization bypass.
- Consultation2.0 h
- Implementation4.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,560.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2016-8362 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2016-8362 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data