CVE-2019-9099
📋 TL;DR
A buffer overflow vulnerability in the built-in web server of affected Moxa MGate devices allows remote attackers to cause denial of service and potentially execute arbitrary code. This affects multiple Moxa MGate industrial protocol gateway models with outdated firmware. Attackers can exploit this without authentication over the network.
💻 Affected Systems
- Moxa MGate MB3170
- Moxa MGate MB3270
- Moxa MGate MB3280
- Moxa MGate MB3480
- Moxa MGate MB3660
- Moxa MGate MB3180
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement within industrial networks, and disruption of critical industrial processes.
Likely Case
Denial of service causing device unavailability and disruption of industrial communications, with potential for limited code execution.
If Mitigated
No impact if devices are patched or properly segmented from untrusted networks.
🎯 Exploit Status
Buffer overflow in web server suggests straightforward exploitation. While no public PoC is documented, similar vulnerabilities in industrial devices are often weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MB3170/MB3270: 4.1+, MB3280/MB3480: 3.1+, MB3660: 2.3+, MB3180: 2.1+
Vendor Advisory: https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
Restart Required: Yes
Instructions:
1. Download appropriate firmware from Moxa support portal. 2. Backup device configuration. 3. Upload firmware via web interface or console. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Disable web server
allDisable the built-in web server if not required for operations
Network segmentation
allIsolate affected devices in separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit access to device management interfaces
- Monitor for unusual traffic patterns or connection attempts to device web ports
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at http://device-ip/ or serial console, compare against patched versions.Check Version:
Via web: Navigate to device IP. Via CLI: Use serial connection and check system info.Verify Fix Applied:
Confirm firmware version matches or exceeds patched versions listed in fix_official.patch_version.📡 Detection & Monitoring
Log Indicators:
- Web server crash logs
- Unusual HTTP requests with long payloads
- Multiple connection attempts to web port
Network Indicators:
- HTTP requests with unusually long headers or parameters to device port 80/443
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
source_ip="*" AND dest_port=80 AND (http_request_length>1000 OR http_user_agent contains "overflow")🔗 References
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01
- https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
- https://www.us-cert.gov/ics/advisories/icsa-20-056-01
