An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html | Exploit Third Party Advisory VDB Entry |
https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 | Exploit Third Party Advisory |
https://seclists.org/bugtraq/2019/Jun/8 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
No history.
Information
Published : 2019-06-07 20:29
Updated : 2024-02-28 17:08
NVD link : CVE-2018-10702
Mitre link : CVE-2018-10702
CVE.ORG link : CVE-2018-10702
JSON object : View
Products Affected
moxa
- awk-3121_firmware
- awk-3121
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')