CVE-2019-9102
Severity CVSS v4.0:
Pending analysis
Type:
CWE-330
Use of Insufficiently Random Value
Publication date:
11/03/2020
Last modified:
21/07/2021
Description
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Base Score 2.0
6.80
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:moxa:mb3170_firmware:*:*:*:*:*:*:*:* | 4.0 (including) | |
cpe:2.3:h:moxa:mb3170:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:moxa:mb3270_firmware:*:*:*:*:*:*:*:* | 4.0 (including) | |
cpe:2.3:h:moxa:mb3270:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:moxa:mb3180_firmware:*:*:*:*:*:*:*:* | 2.0 (including) | |
cpe:2.3:h:moxa:mb3180:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:moxa:mb3280_firmware:*:*:*:*:*:*:*:* | 3.0 (including) | |
cpe:2.3:h:moxa:mb3280:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:moxa:mb3480_firmware:*:*:*:*:*:*:*:* | 3.0 (including) | |
cpe:2.3:h:moxa:mb3480:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:moxa:mb3660_firmware:*:*:*:*:*:*:*:* | 2.2 (including) | |
cpe:2.3:h:moxa:mb3660:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page