PT-2017-3804 · Moxa · Mgate

Published 2017-08-09 · Updated 2017-08-09

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa MGate versions MB3170, MB3180, MB3270, MB3280, MB3480, MB3660

Description The issue is related to a buffer overflow in the stack when handling input data in the SysChallenge parameter. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted packet.

Recommendations For Moxa MGate versions MB3170, MB3180, MB3270, MB3280, MB3480, MB3660, consider restricting access to the vulnerable SysChallenge parameter until a patch is available. As a temporary workaround, avoid using the SysChallenge parameter in the affected API endpoint until the issue is resolved.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2019-03267

Affected Products

Mgate

References · 2

• https://bdu.fstec.ru/vul/2019-03267 · Security Note
• https://moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities · Note