PT-2019-8763 · Moxa · Moxa Awk-3121

Samuel Huntley · Published 2019-06-07 · Updated 2019-06-11 · CVE-2018-10696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa AWK-3121 version 1.14

Description An issue was discovered in the device's web interface, which allows an administrator to manage the device. However, this interface is not protected against CSRF attacks, allowing an attacker to trick an administrator into executing actions without their knowledge. This is demonstrated by the "forms/iw webSetParameters" and "forms/webSetMainRestart" URIs.

Recommendations For Moxa AWK-3121 version 1.14, as a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the "forms/iw webSetParameters" and "forms/webSetMainRestart" URIs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-10696

Affected Products

Moxa Awk-3121

References · 6

• 🔥 https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 · Exploit
• 🔥 http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10696 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10696 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• https://t.me/cibsecurity/4786 · Telegram Post