CVE-2016-9333 Moxa CVE debrief

Who should care

Organizations running Moxa SoftCMS, especially versions 1.5 and earlier, should treat this as a high-priority issue. Security teams, OT/ICS administrators, and anyone exposing SoftCMS to untrusted networks should review affected deployments immediately.

Technical summary

The NVD entry maps this issue to CWE-89 (SQL Injection) and marks cpe:2.3:a:moxa:softcms:* with vulnerable versions through 1.5. The vulnerability is described as improper input sanitization in the SoftCMS application, which may let a remote attacker inject SQL and obtain administrator-level access. The CVSS vector shows no privileges or user interaction required, consistent with a remotely exploitable application flaw.

Defensive priority

Critical. The combination of remote exploitability, no authentication requirement, and full CIA impact makes this a top-priority remediation item for any exposed or operational SoftCMS instance.

Recommended defensive actions

• Identify all Moxa SoftCMS deployments and confirm whether any instance is running version 1.5 or earlier.
• Upgrade to SoftCMS version 1.6 or later, which is outside the affected range listed in the NVD record.
• If immediate upgrading is not possible, restrict network exposure to trusted management networks and limit access as much as operationally feasible.
• Review application and database logs for unexpected SQL activity or abnormal administrator logins tied to SoftCMS.
• Apply layered controls such as segmentation and access filtering to reduce reachability from untrusted networks.
• Reassess any remote administration paths that could expose SoftCMS to attackers and remove unnecessary exposure.

Evidence notes

This debrief is based only on the supplied NVD-derived corpus and official links. The source record states that Moxa SoftCMS prior to version 1.6 is affected, describes the flaw as a SQL injection that can grant administrator privilege, and lists CWE-89 with CVSS 3.0 9.8. The record also cites ICS-CERT advisory ICSA-16-322-02 and SecurityFocus BID 94394 as references, but no additional claims are made beyond the supplied text.

Official resources