CVE-2019-9098

Vulnerability

An integer overflow vulnerability (CWE-680) exists in the built-in web server of Moxa MB3170, MB3270, MB3280, MB3480, MB3660, and MB3180 series protocol gateways. The flaw causes unexpected memory allocation that can lead to a buffer overflow. Affected firmware versions are: MB3170 and MB3270 series Version 4.0 or lower, MB3280 and MB3480 series Version 3.0 or lower, MB3660 series Version 2.2 or lower, and MB3180 series Version 2.0 or lower [1][2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending specially crafted requests to the built-in web server. No user interaction or special network position is required, as the vulnerability is remotely exploitable with low skill level [1].

Impact

Successful exploitation allows an attacker to cause a denial-of-service (DoS) condition on the affected device. The CVSS v3 base score is 7.5 with a vector string of (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity compromise [1].

Mitigation

Moxa has released firmware updates to address this vulnerability: Version 4.1 for MB3170 and MB3270 series, Version 3.1 for MB3280 and MB3480 series, Version 2.3 for MB3660 series, and Version 2.1 for MB3180 series. Users should update to the latest firmware versions available from Moxa's support site [1][2].