Product support

Security Advisories

SUMMARY

MGate 5105-MB-EIP Series Protocol Gateways Vulnerabilities

  • Version: V1.1
  • Release Date: Jul 10, 2020
  • Reference:
    • CVE-2020-15494, CVE-2020-15493
    • ZDI-CAN-10791, ZDI-CAN-10792

Multiple vulnerabilities were identified in Moxa’s MGate 5105-MB-EIP Series Protocol Gateways. In response to this, Moxa has developed a solution to address these vulnerabilities.

The identified vulnerability types and potential impacts are shown below:

Item Vulnerability Type Impact
1 Authentication Bypass by Capture-replay
(CWE-294)
CVE-2020-15494, ZDI-CAN-10791 
This vulnerability allows an attacker to obtain the session ID of the connection between the host and the device.
2 Exposure of Sensitive Information to an Unauthorized Actor
(CEW-200)
CVE-2020-15493, ZDI-CAN-10792 
This vulnerability allows an attacker to decrypt the encrypted configuration file of the device.
AFFECTED PRODUCTS AND SOLUTIONS

Affected Products:

The affected products and firmware versions are shown below.

Product Series Affected Versions
MGate 5105-MB-EIP Series Firmware Version 4.2 or lower

 

Solutions:

Moxa has developed an appropriate solution to address the vulnerabilities. The solution for affected products is shown below.

Product Series Solutions
MGate 5105-MB-EIP Series
  1. Please contact Moxa's Technical Support Team to get and install the related security patch.
  2. Disable “Moxa Command” under Console Settings.
  3. If you need to enable “Moxa Command”, we recommend enabling the security features below:
  • Enable “Apply additional restrictions” to prevent unauthorized computer accessing the MGate 5105-MB-EIP
  • Add your computer’s IP address to the IP allowlist.

Acknowledgment:

We would like to express our appreciation to Philippe Lin, Marco Balduzzi, Luca Bongiorni, Ryan Flores, Charles Perine, and Rainer Vosseler who worked with Trend Micro’s Zero Day Initiative to report the vulnerabilities, and also helped us enhance the security of our products and provide a better service to our customers.
 

Revision History:

VERSION DESCRIPTION RELEASE DATE
1.0 First Release. Jul 10, 2020
1.1 Added information directing users to get the related security patch from Moxa’s Technical Support Team. Jul 31, 2020

Relevant Products

MGate 5105-MB-EIP Series ·

  •   Print this page
  • You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
Added To Bag