Use of a broken or risky cryptographic algorithm in Moxa products - CVE-2019-9095

Vulnerability identifier: #VU25664

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9095

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected products use a weak cryptographic algorithm with predictable variables. A remote attacker can gain unauthorized access to sensitive information on the system.

Moxa MGate MB3180 Series
Moxa MGate MB3480 Series
Moxa MGate MB3660 Series
Moxa MGate MB3170 Series
Moxa MGate MB3280 Series
Moxa MGate MB3270 Series

Install updates from vendor's website.

Moxa MGate MB3180 Series - update to 2.1
Moxa MGate MB3480 Series - update to 3.1
Moxa MGate MB3660 Series - update to 2.3
Moxa MGate MB3170 Series - update to 4.1
Moxa MGate MB3280 Series - update to 4.0
Moxa MGate MB3270 Series - update to 4.1

• https://ics-cert.us-cert.gov/advisories/icsa-20-056-01
• https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities

• Multiple vulnerabilities in Moxa MB3xxx Series Protocol Gateways