An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html | Exploit Third Party Advisory VDB Entry |
https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 | Third Party Advisory |
https://seclists.org/bugtraq/2019/Jun/8 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
No history.
Information
Published : 2019-06-07 20:29
Updated : 2024-02-28 17:08
NVD link : CVE-2018-10698
Mitre link : CVE-2018-10698
CVE.ORG link : CVE-2018-10698
JSON object : View
Products Affected
moxa
- awk-3121_firmware
- awk-3121
CWE
CWE-311
Missing Encryption of Sensitive Data