PT-2020-1752 · Moxa · Moxa Awk-3131A

Published 2020-02-25 · Updated 2022-06-13 · CVE-2019-5141

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13

Description A command injection vulnerability exists in the iw webs functionality, allowing an attacker to gain remote control over the device. This can be achieved by sending specially crafted commands, utilizing the iw serverip parameter, which can cause user input to be reflected in a subsequent iw system call. An attacker can exploit this vulnerability while authenticated as a low-privilege user.

Recommendations For Moxa AWK-3131A firmware version 1.13, consider disabling the iw webs functionality until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the iw serverip parameter to minimize the risk of remote control over the device. Avoid using the iw serverip parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-00992

CVE-2019-5141

Affected Products

Moxa Awk-3131A

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0930 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5141 · Security Note
• https://bdu.fstec.ru/vul/2020-00992 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5141 · Vendor Advisory
• https://t.me/cvenotify/1207 · Telegram Post
• https://moxa.ru/novosti/tidings/prod/ustranenie-uyazvimostej-tochek-dostupa-moxa-awk-3131a · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0929 · Note
• https://moxa.com/en/support/support/security-advisory/awk-3131a-series-industrial-ap-bridge-client-vulnerabilities · Note
• https://t.me/cvenotify/31539 · Telegram Post