CVE-2021-33824

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-18 · updated 2026-06-17
Weakness: CWE-400

Description

An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.

Affected products

Moxa Mgate Mb3180 Firmware: 2.1-build_18113012

References

https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33824.md
https://github.com/shekyan/slowhttptest
https://www.moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series
https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33824.md
https://github.com/shekyan/slowhttptest
https://www.moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series

Get alerted when CVE-2021-33824 or the next vulnerability affects your stack