An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html | Exploit Third Party Advisory VDB Entry |
https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 | Exploit Third Party Advisory |
https://seclists.org/bugtraq/2019/Jun/8 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
No history.
Information
Published : 2019-06-07 20:29
Updated : 2024-02-28 17:08
NVD link : CVE-2018-10695
Mitre link : CVE-2018-10695
CVE.ORG link : CVE-2018-10695
JSON object : View
Products Affected
moxa
- awk-3121_firmware
- awk-3121
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer