PT-2019-8763 · Moxa · Moxa Awk-3121

Samuel Huntley · Publicado 2019-06-07 · Atualizado 2019-06-11 · CVE-2018-10696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa AWK-3121 version 1.14

Description An issue was discovered in the device's web interface, which allows an administrator to manage the device. However, this interface is not protected against CSRF attacks, allowing an attacker to trick an administrator into executing actions without their knowledge. This is demonstrated by the "forms/iw webSetParameters" and "forms/webSetMainRestart" URIs.

Recommendations For Moxa AWK-3121 version 1.14, as a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the "forms/iw webSetParameters" and "forms/webSetMainRestart" URIs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-10696

Produtos afetados

Moxa Awk-3121

Referências · 6

• 🔥 https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 · Exploit
• 🔥 http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html · Exploit
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• https://t.me/cibsecurity/4786 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-10696 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10696 · Aviso do Fabricante