PT-2017-9762 · Moxa · Moxa Awk-3131A Wireless Access Point

Published 2017-04-13 · Updated 2022-12-13 · CVE-2016-8720

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A Wireless Access Point version 1.1

Description An exploitable HTTP Header Injection issue exists in the Web Application functionality. A specially crafted HTTP request can inject a payload in the bkpath parameter, which will be copied into the Location header of the HTTP response.

Recommendations For Moxa AWK-3131A Wireless Access Point version 1.1, consider restricting access to the Web Application functionality until a fix is available. As a temporary workaround, avoid using the bkpath parameter in HTTP requests to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2016-8720

Affected Products

Moxa Awk-3131A Wireless Access Point

References · 4

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0234 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-8720 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8720 · Vendor Advisory
• https://t.me/cvenotify/39764 · Telegram Post