PT-2020-1747 · Moxa · Moxa Awk-3131A

Carl Hurd + 1 · Published 2020-02-25 · Updated 2022-06-13 · CVE-2019-5136

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13

Description A privilege escalation issue exists in the iw console functionality, allowing an attacker to escape the restricted console and gain system access as the root user. This can be triggered by sending specially crafted commands while authenticated as a low-privilege user. The vulnerability is related to inadequate access control in the iw console component.

Recommendations For Moxa AWK-3131A firmware version 1.13, consider restricting access to the iw console functionality until a patch is available. As a temporary workaround, limit the use of the console to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

BDU:2020-00987

CVE-2019-5136

Affected Products

Moxa Awk-3131A

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0925 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5136 · Security Note
• https://bdu.fstec.ru/vul/2020-00987 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5136 · Vendor Advisory
• https://moxa.ru/novosti/tidings/prod/ustranenie-uyazvimostej-tochek-dostupa-moxa-awk-3131a · Note
• https://t.me/cvenotify/1202 · Telegram Post
• https://moxa.com/en/support/support/security-advisory/awk-3131a-series-industrial-ap-bridge-client-vulnerabilities · Note