Security readout for executives and security teams
Plain-English summary
CVE-2016-0879 affects Moxa EDR-G903 secure routers before firmware 3.4.12. After a configuration import, the device may leave copied configuration and log files behind. A remote attacker could request those files at an unspecified URL and obtain sensitive operational information.
Executive priority
Treat this as a targeted industrial-network confidentiality risk, not a broad emergency. Prioritize remediation for routers exposed to less-trusted networks or protecting sensitive operational environments.
Technical view
The issue is an information exposure flaw in Moxa Secure Router EDR-G903 import handling. Firmware before 3.4.12 does not delete copied configuration and log files after import completion. The public record says remote attackers can obtain those files by requesting an unspecified URL; no CVSS or CWE details are provided in the bundle.
Likely exposure
Exposure is most likely where affected EDR-G903 management services are reachable by untrusted networks. The bundle does not identify other products, CPEs, default exposure, authentication requirements, or the exact URL path.
Exploitation context
The provided sources do not indicate active exploitation, and the CVE is not listed as KEV in the bundle. Exploitability is described only at a high level: remote file retrieval from an unspecified URL after import-related copies remain on the device.
Researcher notes
The public bundle lacks CVSS, CWE, CPE, authentication context, and the vulnerable URL. Validation should avoid probing for unknown file paths beyond authorized checks. Focus on version confirmation, advisory review, and evidence of unexpected file retrieval attempts.
Mitigation direction
- Identify any Moxa EDR-G903 routers running firmware before 3.4.12.
- Upgrade affected EDR-G903 devices to firmware 3.4.12 or later where applicable.
- Review Moxa and CISA/ICS-CERT advisory guidance before applying compensating controls.
- Limit management access to trusted administrative networks while remediation is pending.
Validation and detection
- Inventory deployed Moxa EDR-G903 devices and record firmware versions.
- Check whether configuration import has been used on vulnerable firmware.
- Review logs for unusual requests to configuration or log file paths.
- Confirm upgraded devices report firmware 3.4.12 or later after maintenance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-0879 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.