Multiple vulnerabilities in Moxa MB3xxx Series Protocol Gateways

1) Stack-based buffer overflow

EUVDB-ID: #VU25660

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9099

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the built-in web server. A remote unauthenticated attacker can trigger stack-based buffer overflow, perform a denial of service (DoS) attack and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU25662

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9098

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to cause a buffer overflow.

The vulnerability exists due to integer overflow. A remote attacker can trigger integer overflow that causes less memory to be allocated than expected, leading to a buffer overflow

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site request forgery

EUVDB-ID: #VU25663

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9102

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in a predictable mechanism of generating tokens. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU25664

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9095

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected products use a weak cryptographic algorithm with predictable variables. A remote attacker can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU25665

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9103

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper access restrictions in the built-in web service. A remote attacker can gain unauthorized access to sensitive information and usernames on the system.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cleartext transmission of sensitive information

EUVDB-ID: #VU25666

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9101

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can gain access to sensitive data.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Weak password requirements

EUVDB-ID: #VU25667

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9096

CWE-ID: CWE-521 - Weak Password Requirements

Exploit availability: No

The vulnerability allows an attacker to perform brute-force attack and guess the password.

The vulnerability exists due to weak password requirements. An attacker can perform a brute-force attack and guess users' passwords.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Cleartext storage of sensitive information

EUVDB-ID: #VU25668

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9104

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to access an administrative account.

The vulnerability exists due to sensitive information is stored in configuration files without encryption. A remote attacker can obtain credentials.

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Incorrectly Specified Destination in a Communication Channel

EUVDB-ID: #VU25669

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9097

CWE-ID: CWE-941 - Incorrectly Specified Destination in a Communication Channel

Exploit availability: No

Install updates from vendor's website.

Moxa MGate MB3170 Series: 1.0 - 4.0

Moxa MGate MB3270 Series: 1.0 - 4.0

Moxa MGate MB3180 Series: 1.0 - 2.0

Moxa MGate MB3280 Series: 1.0 - 3.0

Moxa MGate MB3480 Series: 1.0 - 3.0

Moxa MGate MB3660 Series: 1.0 - 2.2

http://ics-cert.us-cert.gov/advisories/icsa-20-056-01
http://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper Authentication

EUVDB-ID: #VU25735

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in authentication process. A remote attacker can bypass authentication by logging in with empty username/password and execute arbitrary actions with administrator privileges on an affected system.

Install updates from vendor's website.

Moxa MGate MB3180 Series: 1.0 - 1.8

Moxa MGate MB3280 Series: 1.0 - 2.8

Moxa MGate MB3480 Series: 1.0 - 2.6

Moxa MGate MB3170 Series: 1.0 - 2.5

Moxa MGate MB3270 Series: 1.0 - 2.8

http://www.moxa.com/en/support/support/security-advisory/mgate-mb3180-3280-3480-3170-3270-vulnerability

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.