CVE-2018-10693

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:moxa:awk-3121_firmware:1.14:*:*:*:*:*:*:*
cpe:2.3:h:moxa:awk-3121:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:41

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html - () http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html -
References () https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 - Exploit, Third Party Advisory () https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 - Exploit, Third Party Advisory
References () https://seclists.org/bugtraq/2019/Jun/8 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Jun/8 - Mailing List, Third Party Advisory

Information

Published : 2019-06-07 20:29

Updated : 2024-11-21 03:41


NVD link : CVE-2018-10693

Mitre link : CVE-2018-10693

CVE.ORG link : CVE-2018-10693


JSON object : View

Products Affected

moxa

  • awk-3121
  • awk-3121_firmware
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer