CVE-2021-4161

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Moxa	MGate MB3180 Series	>= all, < 2.2
Moxa	MGate MB3280 Series	all 4.1
Moxa	MGate MB3480 Series	all 3.2

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-357-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-357-01Third Party Advisory, US Government Resource

Timeline

Published: Dec 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-416117.5An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly CVE-2021-416128.8An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract ins CVE-2021-416134.3An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EE CVE-2021-416147.8An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program CVE-2021-416159.8websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinpara CVE-2021-416169.8Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY,CVE-2021-416177.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplement CVE-2021-416197.2An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configura CVE-2021-41624.3archivy is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416345.3A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.CVE-2021-416358.8When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations o CVE-2021-416366.5MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire