The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.
Fixes

Solution

No solution given by the vendor.


Workaround

The hardware limitation of MB-Gateway does not provide for the implementation of proper access control update. AutomationDirect recommends that users plan for replacement of MB-Gateway with EKI-1221-CE https://www.automationdirect.com/adc/shopping/catalog/communications/protocol_gateways/modbus_gateways/eki-1221-ce . If an immediate replacement is not feasible, AutomationDirect recommends considering the following interim steps until the programming software can be updated: * Restrict network exposure: Ensure devices affected are not accessible from the Internet or untrusted networks. Place them behind firewalls. * Use dedicated, secure internal networks or air-gapped systems for communication with programmable devices. * Control Access: Restrict physical and logical access to authorized personnel only. * Implement Whitelisting: Use application whitelisting to allow only pre-approved and trusted access. Block untrusted or unauthorized applications. * Monitor and Log Activity: Enable logging and monitoring of system activities to detect potential anomalies or unauthorized actions. Regularly review logs for suspicious activity. * Use Secure Backup and Recovery: Regularly back up the workstation and its configurations to a secure location. Test recovery procedures to ensure minimal downtime in the event of an incident. * Plan for device replacement: Organizations should begin evaluating and migrating to supported hardware with active vendor support.

History

Thu, 22 May 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 21 May 2025 20:00:00 +0000

Type Values Removed Values Added
Description The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.
Title AutomationDirect MB-Gateway Missing Authentication for Critical Function
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-05-22T18:49:49.738Z

Reserved: 2025-05-14T16:57:44.359Z

Link: CVE-2025-36535

cve-icon Vulnrichment

Updated: 2025-05-22T18:48:57.063Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-05-21T20:15:31.533

Modified: 2025-05-21T20:24:58.133

Link: CVE-2025-36535

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-06-27T14:10:59Z