An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions…

published 2017-02-13 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-10171

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 20.2%; EPSS 20.2% chance of exploitation in 30 days, percentile 97%
public exploits: 2; Metasploit

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-336-02A updated 2025-06-05 cvss 9.8

Moxa NPort Device Vulnerabilities

Moxa NPort 5100A Series <1.4 Moxa NPort 5110 <2.7 Moxa NPort 5130/5150 Series <3.7 Moxa NPort 5150AI-M12 Series <1.3 Moxa NPort 5200 Series <2.9 Moxa NPort 5200A Series <1.4

+10 more productsfewer

Moxa NPort 5250AI-M12 Series <1.3 Moxa NPort 5400 Series <3.12 Moxa NPort 5450AI-M12 Series <1.3 Moxa NPort 5600 Series <3.8 Moxa NPort 5600-8-DT Series <2.5 Moxa NPort 5600-8-DTL Series <2.5 Moxa NPort 6000 series <1.16 Moxa NPort 6110 series Moxa NPort IA5450A <v1.4 Moxa NPort P5150A <1.4

affected: mitigation “Moxa has released new firmware versions, which address the identified vulnerabilities in all but one of the affected NPort devices. Moxa recommends installing the new firmware version.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2015-07-28 First public exploit (Metasploit auxiliary/admin/scada/moxa_credentials_recovery)
2017-02-13 Published

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 5 mo ago (2026-06-02)

Exploit prediction

20.21% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/admin/scada/moxa_credentials_recovery Moxa Device Credential Retrieval metasploit auxiliary, normal rank, 2015-07-28
Metasploit auxiliary/scanner/scada/moxa_discover Moxa UDP Device Discovery metasploit auxiliary, normal rank

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a Moxa NPort

Classification

Weakness

CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-287 Improper Authentication

References

ics-cert.us-cert.gov /advisories/ICSA-16-336-02
third-party-advisory, us-government-resource
securityfocus.com /bid/85965
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-9361
NVD CVE-2016-9361

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary