PT-2017-3810 · Moxa · Mgate Mb3180+5

Evgeniy Druzhinin + 2 · Publicado 2017-05-09 · Atualizado 2020-03-17 · CVE-2019-9096

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Moxa MGate MB3170 versions prior to 4.1 Moxa MGate MB3180 versions prior to 2.1 Moxa MGate MB3270 versions prior to 4.1 Moxa MGate MB3280 versions prior to 3.1 Moxa MGate MB3480 versions prior to 3.1 Moxa MGate MB3660 versions prior to 2.3

Description The issue is related to insufficient password requirements for the MGate web application, which may allow an attacker to gain access by brute-forcing account passwords. This can enable a remote attacker to gain full access to the system by directly guessing the credentials.

Recommendations For Moxa MGate MB3170 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3180 versions prior to 2.1, update to version 2.1 or later. For Moxa MGate MB3270 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3280 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3480 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3660 versions prior to 2.3, update to version 2.3 or later.

Correção

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

BDU:2019-03273

CVE-2019-9096

Produtos afetados

Mgate Mb3170

Mgate Mb3180

Mgate Mb3270

Mgate Mb3280

Mgate Mb3480

Mgate Mb3660

Referências · 6

• https://us-cert.gov/ics/advisories/icsa-20-056-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9096 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03273 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9096 · Aviso do Fabricante
• https://moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities · Aviso do Fabricante
• https://t.me/cvenotify/1513 · Publicação no Telegram