PT-2019-8765 · Moxa · Moxa Awk-3121

Samuel Huntley · Published 2019-06-07 · Updated 2023-02-28 · CVE-2018-10698

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa AWK-3121 version 1.14

Description An issue was discovered where the device enables an unencrypted TELNET service by default. This allows an attacker who has gained a Man-In-The-Middle (MITM) position to easily sniff the traffic between the device and the user. Additionally, an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user.

Recommendations For Moxa AWK-3121 version 1.14, consider disabling the TELNET service or changing the default credentials to prevent unauthorized access. As a temporary workaround, restrict access to the TELNET daemon until a more secure configuration or patch is available.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-10698

Affected Products

Moxa Awk-3121

References · 6

• 🔥 http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-10698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10698 · Security Note
• https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 · Note
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• https://t.me/cibsecurity/4784 · Telegram Post