CVE-2019-9095
📋 TL;DR
This vulnerability allows attackers to intercept weakly encrypted passwords on Moxa MGate industrial protocol gateways, potentially gaining administrative access. Affected devices include multiple MGate models with outdated firmware versions.
💻 Affected Systems
- Moxa MGate MB3170
- Moxa MGate MB3270
- Moxa MGate MB3280
- Moxa MGate MB3480
- Moxa MGate MB3660
- Moxa MGate MB3180
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of industrial control system gateways, allowing attackers to manipulate industrial processes, disrupt operations, or pivot to other critical systems.
Likely Case
Unauthorized administrative access to gateways, enabling configuration changes, data interception, or denial of service against connected industrial equipment.
If Mitigated
Limited impact if strong network segmentation, monitoring, and access controls prevent exploitation attempts from reaching vulnerable devices.
🎯 Exploit Status
Exploitation requires network access to intercept traffic, but the weak encryption makes password recovery straightforward once intercepted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MB3170/MB3270: 4.1+, MB3280/MB3480: 3.1+, MB3660: 2.3+, MB3180: 2.1+
Vendor Advisory: https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
Restart Required: Yes
Instructions:
1. Download appropriate firmware from Moxa support portal. 2. Backup current configuration. 3. Upload firmware via web interface or console. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable devices in separate network segments with strict firewall rules to prevent unauthorized access.
Access Control Lists
allImplement strict ACLs to limit which IP addresses can communicate with the management interfaces of affected devices.
🧯 If You Can't Patch
- Implement network monitoring and intrusion detection for traffic to/from affected devices
- Change administrative passwords regularly and use complex credentials
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > System Information) or console command 'show version'Check Version:
show versionVerify Fix Applied:
Confirm firmware version meets minimum patched version requirements and test password transmission with network analyzer📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts
- Successful logins from unusual IP addresses
- Configuration changes from unexpected sources
Network Indicators:
- Unusual traffic patterns to/from MGate devices
- Password interception attempts on management ports
SIEM Query:
source_ip IN (mgate_device_ips) AND (event_type='authentication' OR event_type='configuration_change')🔗 References
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01
