Skip to content
Fencer Vulns
critical 9.8

CVE-2016-5804 json

Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use we…

published 2016-07-15 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-6739

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.

Patch / fix

  • moxa mgate_mb3180_firmware 1.8
  • moxa mgate_mb3280_firmware 2.7
  • moxa mgate_mb3480_firmware 2.6
  • moxa mgate_mb3170_firmware 2.5
  • moxa mgate_mb3270_firmware 2.7

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-196-02 updated cvss 9.1

Moxa MGate Authentication Bypass Vulnerability

  • Moxa MGate MB3170 <=v2.5 Moxa MGate MB3180 <=v1.8 Moxa MGate MB3270 <=v2.7 Moxa MGate MB3280 <=v2.7 Moxa MGate MB3480 <=v2.6
    affected: mitigation “MB3170, v2.5 and MB3270, v2.7 (http://www.moxa.com/support/sarch_result.aspx?type=soft&prod_id=74&type_id=4)”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-326 Inadequate Encryption Strength

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.