CVE-2019-9099

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-11 · updated 2026-06-17
Weakness: CWE-120

Description

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A Buffer overflow in the built-in web server allows remote attackers to initiate DoS, and probably to execute arbitrary code (issue 1 of 2).

Affected products

Moxa Mb3170 Firmware: through 4.0
Moxa Mb3180 Firmware: through 2.0
Moxa Mb3270 Firmware: through 4.0
Moxa Mb3280 Firmware: through 3.0
Moxa Mb3480 Firmware: through 3.0
Moxa Mb3660 Firmware: through 2.2

References

https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
https://www.us-cert.gov/ics/advisories/icsa-20-056-01
https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities
https://www.us-cert.gov/ics/advisories/icsa-20-056-01

Get alerted when CVE-2019-9099 or the next vulnerability affects your stack