Vulnerability Spotlight: Hard-coded Credential Flaw in Moxa ICS Wireless Access Points Identified and Fixed
Summary: Cisco Talos disclosed TALOS-2016-0231 (CVE-2016-8717), a hard-coded credential vulnerability in Moxa AWK-3131A Series industrial wireless AP/bridge/client devices that leaves an undocumented root-level account with no mechanism to disable or remove it permanently. An attacker could use the account, with the username 94jo3dkru4 and password moxaiwroot, to gain complete remote control of the device, and Moxa has released a software update to address it and other bugs.
What's compelling: A root account that cannot be disabled or removed means every unpatched AWK-3131A on an industrial network is reachable with a published username and password, and Talos's fallback advice is to shut off SSH and Telnet rather than close the account.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8717
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026