Vulnerability · Published Dec 27, 2021 · Assigned by icscert
CVE-2021-4161ICSA-21-357-01 Moxa MGate Protocol Gateways
Critical 9.8
In plain English
A critical-severity security flaw in MGate MB3180 Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moxa | MGate MB3180 Series | all – before 2.2 |
| Moxa | MGate MB3280 Series | all 4.1 |
| Moxa | MGate MB3480 Series | all 3.2 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-357-01 x_refsource_MISC