CVE-2015-6480

High

Published: 21/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The MessageBrokerServlet servlet in Moxa OnCell Central Manager before version 2.2 does not require authentication, allowing remote attackers to gain administrative access via a command, such as the addUserAndGroup action.

Risk Assessment

The lack of authentication poses a serious security risk, enabling attackers to fully take control of the system.

Recommendation

It is recommended to update Moxa OnCell Central Manager to the latest version to implement the necessary authentication mechanisms.

Other vulnerabilities in Moxa OnCell Central Manager

CVE-2015-6481High
The login function in the RequestController class in Moxa OnCell Central Manager before version 2.2 has a hardcoded root password, allowing remote attackers to gain administrative access via a login session.

Original NVD description (English source)

The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.