Skip to content
Fencer Vulns
critical 9.1

CVE-2017-16727 json

A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11.

published 2017-12-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-7911

cvss
9.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely compromise the confidentiality and integrity of the wireless traffic.

Patch / fix

  • moxa nport_w2150a_firmware 1.11
  • moxa nport_w2250a_firmware 1.11

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-17-355-01 updated cvss 6.5

ICSA-17-355-01_Moxa NPort W2150A and W2250A

  • Moxa NPort W2150A < 1.11 Moxa NPort W2250A < 1.11
    affected: mitigation “Moxa has produced new firmware Version 2.1 for the affected devices that can be downloaded from:” urldefense.proofpoint.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.96% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • n/a Moxa NPort W2150A and W2250A

Classification

Weakness
  • CWE-255 Credentials Management Errors
  • CWE-521 Weak Password Requirements

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.