What’s Vulnerable › Vulnerabilities

CVE-2016-5804

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-07-15 · updated 2026-06-17
• Weakness: CWE-326

Description

Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.

Affected products

• Moxa Mgate Mb3170 Firmware: before 2.5 — fixed in 2.5
• Moxa Mgate Mb3180 Firmware: before 1.8 — fixed in 1.8
• Moxa Mgate Mb3270 Firmware: before 2.7 — fixed in 2.7
• Moxa Mgate Mb3280 Firmware: before 2.7 — fixed in 2.7
• Moxa Mgate Mb3480 Firmware: before 2.6 — fixed in 2.6

How to fix

Upgrade to a fixed version: Moxa Mgate Mb3170 Firmware 2.5; Moxa Mgate Mb3180 Firmware 1.8; Moxa Mgate Mb3270 Firmware 2.7; Moxa Mgate Mb3280 Firmware 2.7; Moxa Mgate Mb3480 Firmware 2.6. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/91777
• https://ics-cert.us-cert.gov/advisories/ICSA-16-196-02
• http://www.securityfocus.com/bid/91777
• https://ics-cert.us-cert.gov/advisories/ICSA-16-196-02

Get alerted when CVE-2016-5804 or the next vulnerability affects your stack