Moxa MB3xxx Series Protocol Gateways
Two separate issues cause a buffer overflow in the built-in web server that may allow a remote attacker to initiate a DoS attack and execute arbitrary code.CVE-2019-9099 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An integer overflow causes unexpected memory allocation that can lead to a buffer overflow.CVE-2019-9098 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism.CVE-2019-9102 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A weak cryptographic algorithm with predictable variables may allow sensitive information to be revealed.CVE-2019-9095 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). An attacker can access sensitive information and usernames via the built-in web service without proper authorizationCVE-2019-9103 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).CVE-2019-9101 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Sensitive information is transmitted over some web applications in clear text.CVE-2019-9096 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Weak password requirements may allow an attacker to gain access by using brute force.CVE-2019-9104 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Sensitive information is stored in configuration files without encryption, which may allow an attacker to access an administrative account.CVE-2019-9097 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).