Metrics
Affected Vendors & Products
Solution
No solution given by the vendor.
Workaround
The hardware limitation of MB-Gateway does not provide for the implementation of proper access control update. AutomationDirect recommends that users plan for replacement of MB-Gateway with EKI-1221-CE https://www.automationdirect.com/adc/shopping/catalog/communications/protocol_gateways/modbus_gateways/eki-1221-ce . If an immediate replacement is not feasible, AutomationDirect recommends considering the following interim steps until the programming software can be updated: * Restrict network exposure: Ensure devices affected are not accessible from the Internet or untrusted networks. Place them behind firewalls. * Use dedicated, secure internal networks or air-gapped systems for communication with programmable devices. * Control Access: Restrict physical and logical access to authorized personnel only. * Implement Whitelisting: Use application whitelisting to allow only pre-approved and trusted access. Block untrusted or unauthorized applications. * Monitor and Log Activity: Enable logging and monitoring of system activities to detect potential anomalies or unauthorized actions. Regularly review logs for suspicious activity. * Use Secure Backup and Recovery: Regularly back up the workstation and its configurations to a secure location. Test recovery procedures to ensure minimal downtime in the event of an incident. * Plan for device replacement: Organizations should begin evaluating and migrating to supported hardware with active vendor support.
Thu, 22 May 2025 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 21 May 2025 20:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality. | |
Title | AutomationDirect MB-Gateway Missing Authentication for Critical Function | |
Weaknesses | CWE-306 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: icscert
Published:
Updated: 2025-05-22T18:49:49.738Z
Reserved: 2025-05-14T16:57:44.359Z
Link: CVE-2025-36535

Updated: 2025-05-22T18:48:57.063Z

Status : Awaiting Analysis
Published: 2025-05-21T20:15:31.533
Modified: 2025-05-21T20:24:58.133
Link: CVE-2025-36535

No data.

Updated: 2025-06-27T14:10:59Z