9.8

CVE-2019-9099

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A Buffer overflow in the built-in web server allows remote attackers to initiate DoS, and probably to execute arbitrary code (issue 1 of 2).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moxa ≫ Mb3170 Firmware Version <= 4.0
   Moxa ≫ Mb3170 Version -
Moxa ≫ Mb3270 Firmware Version <= 4.0
   Moxa ≫ Mb3270 Version -
Moxa ≫ Mb3180 Firmware Version <= 2.0
   Moxa ≫ Mb3180 Version -
Moxa ≫ Mb3280 Firmware Version <= 3.0
   Moxa ≫ Mb3280 Version -
Moxa ≫ Mb3480 Firmware Version <= 3.0
   Moxa ≫ Mb3480 Version -
Moxa ≫ Mb3660 Firmware Version <= 2.2
   Moxa ≫ Mb3660 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.05% 0.896
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-056-01
Third Party Advisory
US Government Resource