PT-2017-3806 · Moxa · Mgate Mb3180+5

Maxim Kozhevnikov

·

Publicado

2017-09-04

·

Atualizado

2021-07-21

·

CVE-2019-9102

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Moxa MGate MB3170 versions prior to 4.1 Moxa MGate MB3180 versions prior to 2.1 Moxa MGate MB3270 versions prior to 4.1 Moxa MGate MB3280 versions prior to 3.1 Moxa MGate MB3480 versions prior to 3.1 Moxa MGate MB3660 versions prior to 2.3
Description The issue is related to a predictable token generation mechanism in the embedded web server of Moxa MGate devices. This allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism, potentially enabling them to perform arbitrary actions on the vulnerable device. The exploitation of this issue can lead to the execution of unauthorized actions on the device through cross-site request forgery.
Recommendations For Moxa MGate MB3170 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3180 versions prior to 2.1, update to version 2.1 or later. For Moxa MGate MB3270 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3280 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3480 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3660 versions prior to 2.3, update to version 2.3 or later.

Correção

CSRF

Use of Insufficiently Random Values

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352CWE-330

Identificadores relacionados

BDU:2019-03269
CVE-2019-9102

Produtos afetados

Mgate Mb3170
Mgate Mb3180
Mgate Mb3270
Mgate Mb3280
Mgate Mb3480
Mgate Mb3660