PT-2021-20336 · Moxa · Moxa Mgate Mb3180

Guan Yu Lai + 2 · Published 2021-06-18 · Updated 2022-07-12 · CVE-2021-33823

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: MOXA Mgate MB3180 version 2.1 Build 18113012

Description: An issue was discovered where an attacker could send a huge amount of TCP SYN packets to exhaust the web service's resources, resulting in a denial-of-service.

Recommendations: For MOXA Mgate MB3180 version 2.1 Build 18113012, consider implementing rate limiting on incoming TCP SYN packets to prevent resource exhaustion. As a temporary workaround, restrict access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-33823

Affected Products

Moxa Mgate Mb3180

References · 6

• 🔥 https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33823.md · Exploit
• https://osv.dev/vulnerability/CVE-2021-33823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33823 · Security Note
• https://moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series · Vendor Advisory
• https://t.me/cvenotify/16556 · Telegram Post
• https://t.me/cibsecurity/25562 · Telegram Post