Search criteria

3 vulnerabilities found for MGate 5105-MB-EIP by Moxa

VAR-202002-1366

Vulnerability from variot - Updated: 2024-11-23 23:01

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. Moxa MGate 5105-MB-EIP For firmware, OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-9552 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. MGate 5105-MB-EIP is an industrial Ethernet gateway that supports MQTT or third-party cloud services (such as Azure and Alibaba Cloud). It can construct Modbus RTU/ASCII/TCP and EtherNet/IP network communications for IIoT applications

Show details on source website
To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "eq",
        "trust": 1.4,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "moxa",
        "version": null
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": null,
        "trust": 0.7,
        "vendor": "moxa",
        "version": null
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "moxa",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:moxa:mgate_5105-mb-eip_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:moxa:mgate_5105-mb-eip-t_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-8858",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2020-8858",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 9.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-002055",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2020-53805",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "zdi-disclosures@trendmicro.com",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-002055",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-8858",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "zdi-disclosures@trendmicro.com",
            "id": "CVE-2020-8858",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-002055",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2020-8858",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-53805",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202002-451",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. Moxa MGate 5105-MB-EIP For firmware, OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-9552 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. MGate 5105-MB-EIP is an industrial Ethernet gateway that supports MQTT or third-party cloud services (such as Azure and Alibaba Cloud). It can construct Modbus RTU/ASCII/TCP and EtherNet/IP network communications for IIoT applications",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-8858",
        "trust": 3.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-214",
        "trust": 2.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-9552",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "id": "VAR-202002-1366",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ],
    "trust": 1.2
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ]
  },
  "last_update_date": "2024-11-23T23:01:31.339000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "MGate 5105-MB-EIP Series Protocol Gateways Vulnerability",
        "trust": 1.5,
        "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
      },
      {
        "title": "Patch for Moxa MGate 5105-MB-EIP operating system command injection vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/235519"
      },
      {
        "title": "Moxa MGate 5105-MB-EIP Fixes for operating system command injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110093"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.9,
        "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
      },
      {
        "trust": 1.6,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-20-214/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-8858"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8858"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-02-11T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "date": "2020-09-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "date": "2020-03-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "date": "2020-02-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "date": "2020-02-14T18:15:11.433000",
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-04-01T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "date": "2020-09-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "date": "2020-03-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "date": "2020-03-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "date": "2024-11-21T05:39:34.993000",
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Moxa MGate 5105-MB-EIP operating system command injection vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "_id": null,
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 0.6
  }
}

CVE-2020-8858 (GCVE-0-2020-8858)

Vulnerability from nvd – Published: 2020-02-13 22:20 – Updated: 2024-08-04 10:12
VLAI
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
zdi
References
Impacted products
Vendor Product Version
Moxa MGate 5105-MB-EIP Affected: firmware version 4.1
Create a notification for this product.
Credits
Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MGate 5105-MB-EIP",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T22:20:44.000Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2020-8858",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MGate 5105-MB-EIP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "firmware version 4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Moxa"
              }
            ]
          }
        },
        "credit": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
            },
            {
              "name": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability",
              "refsource": "MISC",
              "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2020-8858",
    "datePublished": "2020-02-13T22:20:44.000Z",
    "dateReserved": "2020-02-11T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:10.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8858 (GCVE-0-2020-8858)

Vulnerability from cvelistv5 – Published: 2020-02-13 22:20 – Updated: 2024-08-04 10:12
VLAI
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
zdi
References
Impacted products
Vendor Product Version
Moxa MGate 5105-MB-EIP Affected: firmware version 4.1
Create a notification for this product.
Credits
Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MGate 5105-MB-EIP",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T22:20:44.000Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2020-8858",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MGate 5105-MB-EIP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "firmware version 4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Moxa"
              }
            ]
          }
        },
        "credit": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
            },
            {
              "name": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability",
              "refsource": "MISC",
              "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2020-8858",
    "datePublished": "2020-02-13T22:20:44.000Z",
    "dateReserved": "2020-02-11T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:10.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}