PT-2017-3807 · Moxa · Mgate Mb3180+5

Published 2017-09-04 · Updated 2021-07-21 · CVE-2019-9095

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa MGate MB3170 versions prior to 4.1 Moxa MGate MB3270 versions prior to 4.1 Moxa MGate MB3280 versions prior to 3.1 Moxa MGate MB3480 versions prior to 3.1 Moxa MGate MB3660 versions prior to 2.3 Moxa MGate MB3180 versions prior to 2.1

Description An issue was discovered that allows an attacker to intercept weakly encrypted passwords, potentially gaining administrative access. The vulnerability is related to the use of an unstable cryptographic algorithm, which can be exploited by a remote attacker to gain unauthorized access to protected information using a configuration file.

Recommendations For Moxa MGate MB3170 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3270 versions prior to 4.1, update to version 4.1 or later. For Moxa MGate MB3280 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3480 versions prior to 3.1, update to version 3.1 or later. For Moxa MGate MB3660 versions prior to 2.3, update to version 2.3 or later. For Moxa MGate MB3180 versions prior to 2.1, update to version 2.1 or later.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-310

CWE-327

Related Identifiers

BDU:2019-03270

CVE-2019-9095

Affected Products

Mgate Mb3170

Mgate Mb3180

Mgate Mb3270

Mgate Mb3280

Mgate Mb3480

Mgate Mb3660

References · 6

• https://bdu.fstec.ru/vul/2019-03270 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9095 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9095 · Vendor Advisory
• https://moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-056-01 · Note
• https://t.me/cvenotify/1512 · Telegram Post