CVE-2019-9096
mediumPriorität · verfolgen · 40OT-Risiko · erhöhtEPSS 0.018 · 78. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. Insufficient password requirements for the MGate web application may allow an attacker to gain access by brute-forcing account passwords.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenweidmueller_psirt
For all potential vulnerabilities, customers can download a patched firmware to secure their Modbus TCP/RTU Gateways properly. Please download and install the latest firmware for your device by following the procedure below: 1. Go to [www.weidmueller.com](https://www.weidmueller.com) (external link). 2. Enter the product number of the Modbus TCP/RTU Gateway you want to update into the search field and press "Enter". 3. On the next page, expand the drop-down menu **"SHOW DOWNLOADS"**. 4. Download the respective firmware from the download table. 5. Install the firmware on your device. Find below the appropriate patched firmware versions for all affected products: | Product number | Product name | Patched firmware version | |----------------|-------------------------------|------------------------------| | 1504460000 | IE-GW-MB-2TX-1RS232/485 | V2.1 (Build 21072817) | | 1504470000 | IE-GWT-MB-2TX-1RS232/485 | V2.1 (Build 21072817) |
- MitigationMB3170 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
- MitigationMB3180 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
- MitigationMB3270 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
- MitigationMB3280 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
- MitigationMB3480 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
- MitigationMB3660 seriescisa_csaf_ot
Use a VPN tunnel for a secure and protected connection between the devices and host PC.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (29)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- VDE-2022-008WEIDMUELLER: Multiple vulnerabilities in Modbus TCP/RTU Gateways2022-04-07csaf · weidmueller_psirtDE
Multiple issues have been found in the affected products. See CVE descriptions for details.
- ICSA-20-056-01Moxa MB3xxx Series Protocol Gateways2020-02-25icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could crash the device, cause a buffer overflow, allow remote execution of arbitrary code, or allow access to sensitive information.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2019-9096cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.0720/cnnvd
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilitiescnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01cnnvd
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilitiesenisa_euvd
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01enisa_euvd
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilitiesVendor Advisorynvd
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01Third Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan