Cross-site request forgery in Moxa products - CVE-2019-9102
Published: February 27, 2020
Vulnerability identifier: #VU25663
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9102
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in a predictable mechanism of generating tokens. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
Affected software
Moxa MGate MB3180 Series
Moxa MGate MB3480 Series
Moxa MGate MB3660 Series
Moxa MGate MB3170 Series
Moxa MGate MB3280 Series
Moxa MGate MB3270 Series
Moxa MGate MB3480 Series
Moxa MGate MB3660 Series
Moxa MGate MB3170 Series
Moxa MGate MB3280 Series
Moxa MGate MB3270 Series
How to mitigate CVE-2019-9102
Install updates from vendor's website.
Moxa MGate MB3180 Series - update to 2.1
Moxa MGate MB3480 Series - update to 3.1
Moxa MGate MB3660 Series - update to 2.3
Moxa MGate MB3170 Series - update to 4.1
Moxa MGate MB3280 Series - update to 4.0
Moxa MGate MB3270 Series - update to 4.1
Moxa MGate MB3480 Series - update to 3.1
Moxa MGate MB3660 Series - update to 2.3
Moxa MGate MB3170 Series - update to 4.1
Moxa MGate MB3280 Series - update to 4.0
Moxa MGate MB3270 Series - update to 4.1