CVE-2021-4161

{"id": "CVE-2021-4161", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-12-27T19:15:08.803", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-357-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server."}, {"lang": "es", "value": "Los productos afectados contienen un firmware vulnerable, lo que podr\u00eda permitir a un atacante husmear el tr\u00e1fico y descifrar los datos de las credenciales de acceso. Esto podr\u00eda dar a un atacante derechos de administrador mediante el servidor web HTTP"}], "lastModified": "2022-01-07T18:11:08.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mgate_mb3180_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E11DB5E-B971-4419-9444-1CEF54F7CB95", "versionEndIncluding": "2.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mgate_mb3180:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EF77C838-FB6C-4A55-B5E5-FA4DDE11F3BA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mgate_mb3280_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE7913FB-83D1-44A5-8DE0-350177265BA4", "versionEndIncluding": "4.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mgate_mb3280:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ECB8238C-7B72-4EEB-A656-090B3E8978D4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mgate_mb3480_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A17484F-2EE1-45FD-8341-EDB01F907AA9", "versionEndIncluding": "3.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mgate_mb3480:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3BEC8167-9069-4DA5-9281-C43AD60CD675"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}