CVE-2019-9095 - OpenCVE

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. An attacker may be able to intercept weakly encrypted passwords and gain administrative access.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Moxa	Mb3280 Firmware Mb3660 Mb3660 Firmware Mb3170 Firmware Mb3480 Mb3480 Firmware Mb3180 Mb3280 Mb3270 Mb3180 Firmware Mb3170 Mb3270 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:moxa:mb3170_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3170:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:moxa:mb3270_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3270:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:moxa:mb3180_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3180:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:moxa:mb3280_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3280:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:moxa:mb3480_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3480:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:moxa:mb3660_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3660:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities	Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-056-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-03-11T14:27:58

Updated: 2020-03-11T14:27:58

Reserved: 2019-02-24T00:00:00

Link: CVE-2019-9095

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-03-11T15:15:16.467

Modified: 2021-07-21T11:39:23.747

Link: CVE-2019-9095

JSON object: View

Redhat Information

No data.

CWE

CWE-327

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-09-25T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. An attacker may be able to intercept weakly encrypted passwords and gain administrative access."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AC:L/AV:L/A:N/C:H/I:N/PR:N/S:U/UI:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-11T14:27:58", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9095", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. An attacker may be able to intercept weakly encrypted passwords and gain administrative access."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AC:L/AV:L/A:N/C:H/I:N/PR:N/S:U/UI:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}, {"name": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities", "refsource": "CONFIRM", "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9095", "datePublished": "2020-03-11T14:27:58", "dateReserved": "2019-02-24T00:00:00", "dateUpdated": "2020-03-11T14:27:58", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3170_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA77E3A9-35F8-46C1-B8DE-9647AFD61639", "versionEndIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3170:-:*:*:*:*:*:*:*", "matchCriteriaId": "02331350-F101-4848-ACC8-128F71158A2B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3270_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "320E0EA8-031F-4FB5-A31E-383CBAB1A7B7", "versionEndIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3270:-:*:*:*:*:*:*:*", "matchCriteriaId": "5B20B91C-1A84-4B6B-9057-ABC2374E749B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3180_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0627A8C8-E7D1-4005-BA45-DD5713A66974", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3180:-:*:*:*:*:*:*:*", "matchCriteriaId": "4CF26E0E-2E1A-4365-8F7D-E668A2856F57", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3280_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE9A7F7F-B24E-40D6-9316-1BC67A826D22", "versionEndIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3280:-:*:*:*:*:*:*:*", "matchCriteriaId": "706A1768-5776-48CC-A4ED-1F73841C9F9A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3480_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "21613C9B-C822-4B51-98D5-88C4A0B7F852", "versionEndIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3480:-:*:*:*:*:*:*:*", "matchCriteriaId": "9B9256FD-5121-4009-8672-D9637053E808", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3660_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "634112A7-C567-43E8-BB61-73779CB43C6D", "versionEndIncluding": "2.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3660:-:*:*:*:*:*:*:*", "matchCriteriaId": "1DC4BC5A-4EDA-448B-B312-C9A9F906E4DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. An attacker may be able to intercept weakly encrypted passwords and gain administrative access."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos Moxa MGate MB3170 y MB3270 versiones anteriores a la versi\u00f3n 4.1, en los dispositivos MB3280 y MB3480 versiones anteriores a la versi\u00f3n 3.1, en los dispositivos MB3660 versiones anteriores a la versi\u00f3n 2.3 y en los dispositivos MB3180 versiones anteriores a la versi\u00f3 n 2.1. Un atacante puede ser capaz de interceptar contrase\u00f1as d\u00e9bilmente cifradas y conseguir acceso administrativo."}], "id": "CVE-2019-9095", "lastModified": "2021-07-21T11:39:23.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "cve@mitre.org", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-11T15:15:16.467", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "nvd@nist.gov", "type": "Primary"}]}