PT-2016-6689 · Moxa · Mgate Mb3180+4

Maxim Rupp · Published 2016-07-15 · Updated 2021-07-16 · CVE-2016-5804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa MGate MB3180 versions 1.8 and earlier Moxa MGate MB3280 versions 2.7 and earlier Moxa MGate MB3480 versions 2.6 and earlier Moxa MGate MB3170 versions 2.5 and earlier Moxa MGate MB3270 versions 2.7 and earlier

Description The issue allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value. This is due to the use of weak encryption.

Recommendations For Moxa MGate MB3180 version 1.8 and earlier, update to version 1.8 or later. For Moxa MGate MB3280 version 2.7 and earlier, update to version 2.7 or later. For Moxa MGate MB3480 version 2.6 and earlier, update to version 2.6 or later. For Moxa MGate MB3170 version 2.5 and earlier, update to version 2.5 or later. For Moxa MGate MB3270 version 2.7 and earlier, update to version 2.7 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2016-5804

Affected Products

Mgate Mb3170

Mgate Mb3180

Mgate Mb3270

Mgate Mb3280

Mgate Mb3480

References · 4

• https://osv.dev/vulnerability/CVE-2016-5804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5804 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-196-02 · Note
• http://securityfocus.com/bid/91777 · Note