Details of VAR-201702-0307

ID

VAR-201702-0307

CVE

CVE-2016-8360

TITLE

Moxa SoftCMS Vulnerability to change memory area

Trust: 0.8

sources: JVNDB: JVNDB-2016-007633

DESCRIPTION

An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code. Moxa SoftCMS Will change the memory area, disturb service operation (DoS) Vulnerabilities exist that could be put into a state or execute arbitrary code.Denial of service caused by attacker changing memory area (DoS) Could be put into a state or execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Moxa SoftCMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of requests to the web server. A crafted URL can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute arbitrary code under the context of Administrator. Moxa SoftCMS is a set of central management software developed by Moxa for large-scale monitoring systems. The software supports real-time video surveillance, video playback, and event management. Moxa SoftCMS is prone to multiple security vulnerabilities

Trust: 3.15

sources: NVD: CVE-2016-8360 // JVNDB: JVNDB-2016-007633 // ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // BID: 94394 // VULHUB: VHN-97180

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-11356

AFFECTED PRODUCTS

vendor:	moxa	model:	softcms	scope:	eq	version:	1.5	Trust: 1.5
vendor:	moxa	model:	softcms	scope:	lte	version:	1.5	Trust: 1.0
vendor:	moxa	model:	softcms	scope:	eq	version:	1.4	Trust: 0.9
vendor:	moxa	model:	softcms	scope:	eq	version:	1.3	Trust: 0.9
vendor:	moxa	model:	softcms	scope:	eq	version:	1.2	Trust: 0.9
vendor:	moxa	model:	softcms	scope:	lt	version:	1.6	Trust: 0.8
vendor:	moxa	model:	softcms	scope:	-	version:	-	Trust: 0.7
vendor:	moxa	model:	softcms	scope:	ne	version:	1.6	Trust: 0.3

sources: ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // BID: 94394 // JVNDB: JVNDB-2016-007633 // CNNVD: CNNVD-201611-432 // NVD: CVE-2016-8360

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-8360
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-8360
value:	HIGH
Trust: 0.8
ZDI:	CVE-2016-8360
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2016-11356
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201611-432
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-97180
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-8360
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
ZDI:	CVE-2016-8360
severity:	HIGH
baseScore:	7.6
vectorString:	AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.7
CNVD:	CNVD-2016-11356
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-97180
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-8360
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // VULHUB: VHN-97180 // JVNDB: JVNDB-2016-007633 // CNNVD: CNNVD-201611-432 // NVD: CVE-2016-8360

PROBLEMTYPE DATA

problemtype:

CWE-415

Trust: 1.9

sources: VULHUB: VHN-97180 // JVNDB: JVNDB-2016-007633 // NVD: CVE-2016-8360

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201611-432

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201611-432

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-007633

PATCH

title:	SoftCMS	url:	http://www.moxa.com/product/SoftCMS.htm	Trust: 0.8
title:	Moxa has issued an update to correct this vulnerability.	url:	https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02	Trust: 0.7
title:	Patch for Moxa SoftCMS Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/84135	Trust: 0.6
title:	Moxa SoftCMS Double release vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65773	Trust: 0.6

sources: ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // JVNDB: JVNDB-2016-007633 // CNNVD: CNNVD-201611-432

EXTERNAL IDS

db:	NVD	id:	CVE-2016-8360	Trust: 4.1
db:	ICS CERT	id:	ICSA-16-322-02	Trust: 2.8
db:	BID	id:	94394	Trust: 2.6
db:	ZDI	id:	ZDI-16-615	Trust: 1.0
db:	JVNDB	id:	JVNDB-2016-007633	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-4032	Trust: 0.7
db:	CNNVD	id:	CNNVD-201611-432	Trust: 0.7
db:	CNVD	id:	CNVD-2016-11356	Trust: 0.6
db:	VULHUB	id:	VHN-97180	Trust: 0.1

sources: ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // VULHUB: VHN-97180 // BID: 94394 // JVNDB: JVNDB-2016-007633 // CNNVD: CNNVD-201611-432 // NVD: CVE-2016-8360

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-16-322-02	Trust: 3.5
url:	http://www.securityfocus.com/bid/94394	Trust: 2.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8360	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-8360	Trust: 0.8
url:	http://www.moxa.com/product/softcms.htm	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-615/	Trust: 0.3

sources: ZDI: ZDI-16-615 // CNVD: CNVD-2016-11356 // VULHUB: VHN-97180 // BID: 94394 // JVNDB: JVNDB-2016-007633 // CNNVD: CNNVD-201611-432 // NVD: CVE-2016-8360

CREDITS

Zhou Yu

Trust: 0.7

sources: ZDI: ZDI-16-615

SOURCES

db:	ZDI	id:	ZDI-16-615
db:	CNVD	id:	CNVD-2016-11356
db:	VULHUB	id:	VHN-97180
db:	BID	id:	94394
db:	JVNDB	id:	JVNDB-2016-007633
db:	CNNVD	id:	CNNVD-201611-432
db:	NVD	id:	CVE-2016-8360

LAST UPDATE DATE

2025-04-20T23:22:30.133000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-16-615	date:	2016-11-23T00:00:00
db:	CNVD	id:	CNVD-2016-11356	date:	2016-11-21T00:00:00
db:	VULHUB	id:	VHN-97180	date:	2017-02-17T00:00:00
db:	BID	id:	94394	date:	2016-12-20T16:03:00
db:	JVNDB	id:	JVNDB-2016-007633	date:	2017-03-08T00:00:00
db:	CNNVD	id:	CNNVD-201611-432	date:	2016-11-22T00:00:00
db:	NVD	id:	CVE-2016-8360	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-16-615	date:	2016-11-23T00:00:00
db:	CNVD	id:	CNVD-2016-11356	date:	2016-11-21T00:00:00
db:	VULHUB	id:	VHN-97180	date:	2017-02-13T00:00:00
db:	BID	id:	94394	date:	2016-11-17T00:00:00
db:	JVNDB	id:	JVNDB-2016-007633	date:	2017-03-08T00:00:00
db:	CNNVD	id:	CNNVD-201611-432	date:	2016-11-22T00:00:00
db:	NVD	id:	CVE-2016-8360	date:	2017-02-13T21:59:00.987