CVE-2018-10697

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:moxa:awk-3121_firmware:1.14:*:*:*:*:*:*:*
cpe:2.3:h:moxa:awk-3121:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:41

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 - Exploit, Third Party Advisory () https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 - Exploit, Third Party Advisory
References () https://seclists.org/bugtraq/2019/Jun/8 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Jun/8 - Mailing List, Third Party Advisory

Information

Published : 2019-06-07 20:29

Updated : 2024-11-21 03:41


NVD link : CVE-2018-10697

Mitre link : CVE-2018-10697

CVE.ORG link : CVE-2018-10697


JSON object : View

Products Affected

moxa

  • awk-3121
  • awk-3121_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')