Lucene search

[email protected]CVE-2017-14459

HistoryApr 13, 2018 - 12:00 a.m.

CVE-2017-14459

2018-04-1300:00:00

CWE-78

[email protected]

web.nvd.nist.gov

os command injection

moxa awk-3131a

firmware vulnerability

telnet

ssh

console login

ieee 802.11

nvd

remote code execution

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.886 High

EPSS

Percentile

98.7%

JSON

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.

Affected configurations

Vulners

NVD

Node

talosmoxaRange≤Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client versions 1.4 - 1.9. In addition

talosmoxaRange≤versions prior to 1.4 appear similarly vulnerable to injection

talosmoxaRange≤but not as easily exploitable (described below). Other models in the AWK product line may likewise be vulnerable but have not been tested.

CPENameOperatorVersion
moxa:awk-3131a_firmwaremoxa awk-3131a firmwareeq1.4
moxa:awk-3131a_firmwaremoxa awk-3131a firmwareeq1.5
moxa:awk-3131a_firmwaremoxa awk-3131a firmwareeq1.6
moxa:awk-3131a_firmwaremoxa awk-3131a firmwareeq1.7

CPE	Name	Operator	Version
moxa:awk-3131a_firmware	moxa awk-3131a firmware	eq	1.4
moxa:awk-3131a_firmware	moxa awk-3131a firmware	eq	1.5
moxa:awk-3131a_firmware	moxa awk-3131a firmware	eq	1.6
moxa:awk-3131a_firmware	moxa awk-3131a firmware	eq	1.7

CNA Affected

[
  {
    "product": "Moxa",
    "vendor": "Talos",
    "versions": [
      {
        "status": "affected",
        "version": "Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client versions 1.4 - 1.9. In addition, versions prior to 1.4 appear similarly vulnerable to injection, but not as easily exploitable (described below). Other models in the AWK product line may likewise be vulnerable but have not been tested."
      }
    ]
  }
]