Moxa created new firmware versions to mitigate an authentication bypass vulnerability in its MGate products, according to a report with ICS-CERT.
This vulnerability, discovered by independent researcher Maxim Rupp, is remotely exploitable.
Moxa said the vulnerability affects the following products:
• MGate MB3180, versions prior to v1.8
• MGate MB3280, versions prior to v2.7
• MGate MB3480, versions prior to v2.6
• MGate MB3170, versions prior to v2.5
• MGate MB3270, versions prior to v2.7
A successful exploit of this vulnerability may allow an attacker to log in as a valid user.
Moxa is a Taiwan-based company that maintains offices in several countries around the world, including the U.S., UK, India, Germany, France, China, Russia, and Brazil.
The affected product, MGate, is a serial to Ethernet modbus gateway. MGate sees action across several sectors, including chemical, commercial facilities, critical manufacturing, emergency services, energy, food and agriculture, government facilities, and water and wastewater systems. Moxa said the product sees use on a global basis, but ends up concentrated mainly in the U.S., Europe, South America, and Taiwan.
An attacker can use accessible information to brute force a parameter that will allow a bypass of authentication mechanisms.
CVE-2016-5804 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.1.
No known public exploits specifically target this vulnerability. However, an attacker with a low skill would be able to exploit this vulnerability.
Moxa released new versions of firmware, which has enhanced the security of the MB3x70 and MB3x80 families. This new firmware is on the Moxa web site at the following locations:
MB3170, v2.5 and MB3270, v2.7