PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8363 Moxa CVE debrief

CVE-2016-8363 is a critical Moxa firmware vulnerability affecting multiple OnCell, AWK, WAC, and TAP product families. NVD rates it CVSS 3.0 10.0 with network attack vector, no privileges, no user interaction, and a changed scope impact. The disclosed impact is arbitrary OS command execution on the server/device, which can lead to full compromise of confidentiality, integrity, and availability.

Vendor
Moxa
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2016-08-07
Original CVE updated
2025-06-05
Advisory published
2016-08-07
Advisory updated
2025-06-05

Who should care

Organizations operating any of the affected Moxa industrial wireless devices and firmware listed in NVD, especially teams responsible for OT/ICS network infrastructure, remote access gateways, and industrial Wi-Fi deployments.

Technical summary

NVD describes the issue as arbitrary OS command execution on the server. The vulnerability is scored CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating remotely reachable exploitation with no authentication or user interaction required and potential impact beyond the vulnerable component. NVD maps the weakness to CWE-264. Affected firmware coverage in NVD includes versions up to 10-31-2016 for the OnCellG3470A-LTE, AWK-4131A, AWK-3131A, and AWK-1131A firmware, and versions up to 05-30-2017 or 06-29-2017 for the other listed AWK/WAC families.

Defensive priority

Critical. This is a remote, unauthenticated command-execution issue with full CIA impact across multiple industrial device families.

Recommended defensive actions

  • Identify whether any of the listed Moxa device families are deployed in your environment.
  • Inventory firmware versions and compare them against the affected version end dates listed in NVD.
  • Apply vendor-recommended remediation or firmware updates referenced by ICS-CERT advisory ICSA-16-308-01 and the NVD record.
  • If immediate patching is not possible, isolate affected devices on restricted management networks and limit administrative access.
  • Review logs and device configuration for unexpected changes consistent with command execution or device takeover.
  • Prioritize exposure reduction for any affected devices reachable from untrusted or broader enterprise networks.

Evidence notes

CVE published by NVD on 2017-02-13T21:59:01.080Z; NVD modified record on 2026-05-13T00:24:29.033Z. NVD references include ICS-CERT advisory ICSA-16-308-01 and SecurityFocus BID 94092. The NVD CPE list marks affected firmware for multiple Moxa products, with version end dates of 10-31-2016, 05-30-2017, and 06-29-2017 depending on product family.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8363 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8363

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8363 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8363

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.