Mgate Mb3170 Series
Monthly
Firmware images pushed to Moxa MGate MB3170 and MB3270 series protocol gateways are not cryptographically validated before installation, so a modified or counterfeit image is flashed with the same trust as a vendor-signed one. Exploitation requires an attacker to already hold high-privilege (administrative) access to the device's firmware update interface and to reach it over the network; once that access exists, no additional weakness is needed and no user interaction is required. Successful abuse yields code execution on the gateway plus persistence across subsequent firmware updates, but the impact is confined to the device itself rather than downstream OT systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. This is a genuine but access-gated integrity flaw rather than a mass-exploitation threat.
Stack-based buffer overflow in the web management interface of Moxa MGate MB3170 and MB3270 series protocol gateways lets an attacker who already holds a valid, low-privilege read-only account corrupt program execution by submitting an over-length account_name value in an account-management request. Because the overwritten stack data can be leveraged to read device memory (including stored credentials), modify arbitrary memory, and crash or hang the device, the impact spans confidentiality, integrity, and availability of both the gateway and the downstream systems it bridges. No public exploit code or active exploitation has been observed (no CISA KEV listing; no public exploit identified at time of analysis), and the realistic barrier is the requirement for valid credentials rather than anonymity - though read-only accounts are often weakly protected or shared, which is why the issue still warrants urgent attention.
Firmware images pushed to Moxa MGate MB3170 and MB3270 series protocol gateways are not cryptographically validated before installation, so a modified or counterfeit image is flashed with the same trust as a vendor-signed one. Exploitation requires an attacker to already hold high-privilege (administrative) access to the device's firmware update interface and to reach it over the network; once that access exists, no additional weakness is needed and no user interaction is required. Successful abuse yields code execution on the gateway plus persistence across subsequent firmware updates, but the impact is confined to the device itself rather than downstream OT systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. This is a genuine but access-gated integrity flaw rather than a mass-exploitation threat.
Stack-based buffer overflow in the web management interface of Moxa MGate MB3170 and MB3270 series protocol gateways lets an attacker who already holds a valid, low-privilege read-only account corrupt program execution by submitting an over-length account_name value in an account-management request. Because the overwritten stack data can be leveraged to read device memory (including stored credentials), modify arbitrary memory, and crash or hang the device, the impact spans confidentiality, integrity, and availability of both the gateway and the downstream systems it bridges. No public exploit code or active exploitation has been observed (no CISA KEV listing; no public exploit identified at time of analysis), and the realistic barrier is the requirement for valid credentials rather than anonymity - though read-only accounts are often weakly protected or shared, which is why the issue still warrants urgent attention.