CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-4161 – ICSA-21-357-01 Moxa MGate Protocol Gateways
https://notcve.org/view.php?id=CVE-2021-4161
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server. Los productos afectados contienen un firmware vulnerable, lo que podría permitir a un atacante husmear el tráfico y descifrar los datos de las credenciales de acceso. Esto podría dar a un atacante derechos de administrador mediante el servidor web HTTP • https://www.cisa.gov/uscert/ics/advisories/icsa-21-357-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-33824
https://notcve.org/view.php?id=CVE-2021-33824
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service. Se ha detectado un problema en MOXA Mgate MB3180 Versión 2.1 Build 18113012. Unos atacantes pueden usar la herramienta slowhttptest para enviar peticiones HTTP incompletas, lo que podría hacer que el servidor siga esperando el paquete para finalizar la conexión, hasta que sean agotados sus recursos. • https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33824.md https://github.com/shekyan/slowhttptest https://www.moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-33823
https://notcve.org/view.php?id=CVE-2021-33823
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service. Se ha detectado un problema en MOXA Mgate MB3180 Versión 2.1 Build 18113012. Un atacante podría enviar una gran cantidad de paquetes TCP SYN para hacer que los recursos del servicio web sean agotados. • https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33823.md https://www.moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series •