PT-2019-8766 · Moxa · Moxa Awk-3121

Samuel Huntley · Publicado 2019-06-07 · Atualizado 2020-08-24 · CVE-2018-10699

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa AWK-3121 version 1.14

Description An issue was discovered in the Moxa AWK-3121 device, specifically in its certfile upload functionality, which allows an administrator to upload a certificate file for connecting to the wireless network. However, this functionality also enables an attacker to execute commands on the device. The iw privatePass parameter in the POST request is susceptible to command injection. By crafting a packet containing shell metacharacters, an attacker can execute the attack.

Recommendations For Moxa AWK-3121 version 1.14, consider disabling the certfile upload functionality until a patch is available to prevent command injection attacks. Restrict access to the iw privatePass parameter in the POST request to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-10699

Produtos afetados

Moxa Awk-3121

Referências · 6

• 🔥 https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 · Exploit
• 🔥 http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html · Exploit
• https://t.me/cibsecurity/4783 · Publicação no Telegram
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10699 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10699 · Aviso do Fabricante