Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for MGate 5105-MB-EIP by Moxa

    VAR-202002-1366

    Vulnerability from variot - Updated: 2024-11-23 23:01

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. Moxa MGate 5105-MB-EIP For firmware, OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-9552 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. MGate 5105-MB-EIP is an industrial Ethernet gateway that supports MQTT or third-party cloud services (such as Azure and Alibaba Cloud). It can construct Modbus RTU/ASCII/TCP and EtherNet/IP network communications for IIoT applications

    Show details on source website
    To clipboard 

    {
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "eq",
        "trust": 1.4,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "moxa",
        "version": null
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": null,
        "trust": 0.7,
        "vendor": "moxa",
        "version": null
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "moxa",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "mgate 5105-mb-eip-t",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "moxa",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:moxa:mgate_5105-mb-eip_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:moxa:mgate_5105-mb-eip-t_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-8858",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2020-8858",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 9.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-002055",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2020-53805",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "zdi-disclosures@trendmicro.com",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-002055",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-8858",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-8858",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "zdi-disclosures@trendmicro.com",
            "id": "CVE-2020-8858",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-002055",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2020-8858",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-53805",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202002-451",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. Moxa MGate 5105-MB-EIP For firmware, OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-9552 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. MGate 5105-MB-EIP is an industrial Ethernet gateway that supports MQTT or third-party cloud services (such as Azure and Alibaba Cloud). It can construct Modbus RTU/ASCII/TCP and EtherNet/IP network communications for IIoT applications",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-8858",
        "trust": 3.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-214",
        "trust": 2.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-9552",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "id": "VAR-202002-1366",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ],
    "trust": 1.2
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      }
    ]
  },
  "last_update_date": "2024-11-23T23:01:31.339000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "MGate 5105-MB-EIP Series Protocol Gateways Vulnerability",
        "trust": 1.5,
        "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
      },
      {
        "title": "Patch for Moxa MGate 5105-MB-EIP operating system command injection vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/235519"
      },
      {
        "title": "Moxa MGate 5105-MB-EIP Fixes for operating system command injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110093"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.9,
        "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
      },
      {
        "trust": 1.6,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-20-214/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-8858"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8858"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-02-11T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "date": "2020-09-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "date": "2020-03-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "date": "2020-02-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "date": "2020-02-14T18:15:11.433000",
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-04-01T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-214",
        "ident": null
      },
      {
        "date": "2020-09-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-53805",
        "ident": null
      },
      {
        "date": "2020-03-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-002055",
        "ident": null
      },
      {
        "date": "2020-03-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202002-451",
        "ident": null
      },
      {
        "date": "2024-11-21T05:39:34.993000",
        "db": "NVD",
        "id": "CVE-2020-8858",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Moxa MGate 5105-MB-EIP operating system command injection vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-53805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "_id": null,
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202002-451"
      }
    ],
    "trust": 0.6
  }
}

    CVE-2020-8858 (GCVE-0-2020-8858)

    Vulnerability from nvd – Published: 2020-02-13 22:20 – Updated: 2024-08-04 10:12
    VLAI
    Summary
    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
    Severity
    8.8 (High)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    zdi
    References
    Impacted products
    Vendor Product Version
    Moxa MGate 5105-MB-EIP Affected: firmware version 4.1
    		Create a notification for this product.
    Credits
    Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MGate 5105-MB-EIP",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T22:20:44.000Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2020-8858",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MGate 5105-MB-EIP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "firmware version 4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Moxa"
              }
            ]
          }
        },
        "credit": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
            },
            {
              "name": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability",
              "refsource": "MISC",
              "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2020-8858",
    "datePublished": "2020-02-13T22:20:44.000Z",
    "dateReserved": "2020-02-11T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:10.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-8858 (GCVE-0-2020-8858)

    Vulnerability from cvelistv5 – Published: 2020-02-13 22:20 – Updated: 2024-08-04 10:12
    VLAI
    Summary
    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
    Severity
    8.8 (High)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    zdi
    References
    Impacted products
    Vendor Product Version
    Moxa MGate 5105-MB-EIP Affected: firmware version 4.1
    		Create a notification for this product.
    Credits
    Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MGate 5105-MB-EIP",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T22:20:44.000Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2020-8858",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MGate 5105-MB-EIP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "firmware version 4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Moxa"
              }
            ]
          }
        },
        "credit": "Dove Chiu, Philippe Lin, Charles Perine, Marco Balduzzi, Ryan Flores, Rainer Vosseler",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-214/"
            },
            {
              "name": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability",
              "refsource": "MISC",
              "url": "https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2020-8858",
    "datePublished": "2020-02-13T22:20:44.000Z",
    "dateReserved": "2020-02-11T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:10.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}