DATABASE RESOURCES PRICING ABOUT US

{"id": "CVE-2021-39279", "vendorId": null, "type": "cve", "bulletinFamily": "NVD", "title": "CVE-2021-39279", "description": "Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.", "published": "2021-09-07T06:15:00", "modified": "2021-09-09T23:33:00", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 9.0}, "severity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39279", "reporter": "cve@mitre.org", "references": ["https://www.moxa.com", "https://packetstormsecurity.com/files/164014"], "cvelist": ["CVE-2021-39279"], "immutableFields": [], "lastseen": "2022-03-23T19:02:55", "viewCount": 49, "enchantments": {"dependencies": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2021-0707"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164014"]}, {"type": "zdt", "idList": ["1337DAY-ID-36699"]}], "rev": 4}, "score": {"value": 5.8, "vector": "NONE"}, "backreferences": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2021-0707"]}, {"type": "zdt", "idList": ["1337DAY-ID-36699"]}]}, "exploitation": null, "vulnersScore": 5.8}, "_state": {"dependencies": 0}, "_internal": {}, "cna_cvss": {"cna": null, "cvss": {}}, "cpe": ["cpe:/o:moxa:wdr-3124a-eu_firmware:2.3", "cpe:/o:moxa:wdr-3124a-us-t_firmware:2.3", "cpe:/o:moxa:oncell_g3470a-lte-eu-t_firmware:1.7", "cpe:/o:moxa:wdr-3124a-eu-t_firmware:2.3", "cpe:/o:moxa:wac-2004_firmware:1.7", "cpe:/o:moxa:wac-1001-t_firmware:2.1", "cpe:/o:moxa:oncell_g3470a-lte-eu_firmware:1.7", "cpe:/o:moxa:tap-323-us-ct-t_firmware:1.3", "cpe:/o:moxa:wdr-3124a-us_firmware:2.3", "cpe:/o:moxa:tap-323-eu-ct-t_firmware:1.3", "cpe:/o:moxa:wac-1001_firmware:2.1", "cpe:/o:moxa:tap-323-jp-ct-t_firmware:1.3"], "cpe23": ["cpe:2.3:o:moxa:wac-1001-t_firmware:2.1:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wac-2004_firmware:1.7:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wdr-3124a-eu-t_firmware:2.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wdr-3124a-us_firmware:2.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:tap-323-jp-ct-t_firmware:1.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:oncell_g3470a-lte-eu_firmware:1.7:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:tap-323-eu-ct-t_firmware:1.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wac-1001_firmware:2.1:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:oncell_g3470a-lte-eu-t_firmware:1.7:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wdr-3124a-eu_firmware:2.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:wdr-3124a-us-t_firmware:2.3:*:*:*:*:*:*:*", "cpe:2.3:o:moxa:tap-323-us-ct-t_firmware:1.3:*:*:*:*:*:*:*"], "cwe": ["CWE-78"], "affectedSoftware": [{"cpeName": "moxa:wac-2004_firmware", "version": "1.7", "operator": "eq", "name": "moxa wac-2004 firmware"}, {"cpeName": "moxa:wac-1001_firmware", "version": "2.1", "operator": "eq", "name": "moxa wac-1001 firmware"}, {"cpeName": "moxa:wac-1001-t_firmware", "version": "2.1", "operator": "eq", "name": "moxa wac-1001-t firmware"}, {"cpeName": "moxa:oncell_g3470a-lte-eu_firmware", "version": "1.7", "operator": "eq", "name": "moxa oncell g3470a-lte-eu firmware"}, {"cpeName": "moxa:oncell_g3470a-lte-eu-t_firmware", "version": "1.7", "operator": "eq", "name": "moxa oncell g3470a-lte-eu-t firmware"}, {"cpeName": "moxa:tap-323-eu-ct-t_firmware", "version": "1.3", "operator": "eq", "name": "moxa tap-323-eu-ct-t firmware"}, {"cpeName": "moxa:tap-323-us-ct-t_firmware", "version": "1.3", "operator": "eq", "name": "moxa tap-323-us-ct-t firmware"}, {"cpeName": "moxa:tap-323-jp-ct-t_firmware", "version": "1.3", "operator": "eq", "name": "moxa tap-323-jp-ct-t firmware"}, {"cpeName": "moxa:wdr-3124a-eu_firmware", "version": "2.3", "operator": "eq", "name": "moxa wdr-3124a-eu firmware"}, {"cpeName": "moxa:wdr-3124a-eu-t_firmware", "version": "2.3", "operator": "eq", "name": "moxa wdr-3124a-eu-t firmware"}, {"cpeName": "moxa:wdr-3124a-us_firmware", "version": "2.3", "operator": "eq", "name": "moxa wdr-3124a-us firmware"}, {"cpeName": "moxa:wdr-3124a-us-t_firmware", "version": "2.3", "operator": "eq", "name": "moxa wdr-3124a-us-t firmware"}], "affectedConfiguration": [{"name": "moxa wac-2004", "cpeName": "moxa:wac-2004", "version": "-", "operator": "eq"}, {"name": "moxa wac-1001", "cpeName": "moxa:wac-1001", "version": "-", "operator": "eq"}, {"name": "moxa wac-1001-t", "cpeName": "moxa:wac-1001-t", "version": "-", "operator": "eq"}, {"name": "moxa oncell g3470a-lte-eu", "cpeName": "moxa:oncell_g3470a-lte-eu", "version": "-", "operator": "eq"}, {"name": "moxa oncell g3470a-lte-eu-t", "cpeName": "moxa:oncell_g3470a-lte-eu-t", "version": "-", "operator": "eq"}, {"name": "moxa tap-323-eu-ct-t", "cpeName": "moxa:tap-323-eu-ct-t", "version": "-", "operator": "eq"}, {"name": "moxa tap-323-us-ct-t", "cpeName": "moxa:tap-323-us-ct-t", "version": "-", "operator": "eq"}, {"name": "moxa tap-323-jp-ct-t", "cpeName": "moxa:tap-323-jp-ct-t", "version": "-", "operator": "eq"}, {"name": "moxa wdr-3124a-eu", "cpeName": "moxa:wdr-3124a-eu", "version": "-", "operator": "eq"}, {"name": "moxa wdr-3124a-eu-t", "cpeName": "moxa:wdr-3124a-eu-t", "version": "-", "operator": "eq"}, {"name": "moxa wdr-3124a-us", "cpeName": "moxa:wdr-3124a-us", "version": "-", "operator": "eq"}, {"name": "moxa wdr-3124a-us-t", "cpeName": "moxa:wdr-3124a-us-t", "version": "-", "operator": "eq"}], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wac-2004_firmware:1.7:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wac-2004:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wac-1001_firmware:2.1:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wac-1001:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wac-1001-t_firmware:2.1:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wac-1001-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:oncell_g3470a-lte-eu_firmware:1.7:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:oncell_g3470a-lte-eu:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:oncell_g3470a-lte-eu-t_firmware:1.7:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:oncell_g3470a-lte-eu-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:tap-323-eu-ct-t_firmware:1.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:tap-323-eu-ct-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:tap-323-us-ct-t_firmware:1.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:tap-323-us-ct-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:tap-323-jp-ct-t_firmware:1.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:tap-323-jp-ct-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wdr-3124a-eu_firmware:2.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wdr-3124a-eu:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wdr-3124a-eu-t_firmware:2.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wdr-3124a-eu-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wdr-3124a-us_firmware:2.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wdr-3124a-us:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}, {"operator": "AND", "children": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:moxa:wdr-3124a-us-t_firmware:2.3:*:*:*:*:*:*:*", "cpe_name": []}]}, {"operator": "OR", "children": [], "cpe_match": [{"vulnerable": false, "cpe23Uri": "cpe:2.3:h:moxa:wdr-3124a-us-t:-:*:*:*:*:*:*:*", "cpe_name": []}]}], "cpe_match": []}]}, "extraReferences": [{"url": "https://www.moxa.com", "name": "https://www.moxa.com", "refsource": "MISC", "tags": ["Vendor Advisory"]}, {"url": "https://packetstormsecurity.com/files/164014", "name": "https://packetstormsecurity.com/files/164014", "refsource": "MISC", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"]}]}

{"checkpoint_advisories": [{"lastseen": "2022-02-16T19:32:32", "description": "A command injection vulnerability exists in Multiple Moxa Products. Successful exploitation of this vulnerability could allow a remote, authenticated attacker to execute arbitrary commands on the affected system.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-09-29T00:00:00", "type": "checkpoint_advisories", "title": "Moxa Multiple Products Command Injection (CVE-2021-39279)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39279"], "modified": "2021-09-29T00:00:00", "id": "CPAI-2021-0707", "href": "", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2022-03-23T04:23:08", "description": "", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-09-01T00:00:00", "type": "zdt", "title": "Moxa Command Injection / Cross Site Scripting Vulnerabilities", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-1914", "CVE-2013-7423", "CVE-2015-0235", "CVE-2015-7547", "CVE-2016-1234", "CVE-2021-39278", "CVE-2021-39279"], "modified": "2021-09-01T00:00:00", "id": "1337DAY-ID-36699", "href": "https://0day.today/exploit/description/36699", "sourceData": "=======================================================================\n title: Multiple vulnerabilities\n product: see \"Vulnerable / tested versions\"\n vulnerable version: see \"Vulnerable / tested versions\"\n fixed version: see \"Solution\"\n CVE number: CVE-2021-39278, CVE-2021-39279\n impact: High\n homepage: https://www.moxa.com/\n found: 2020-08-31\n by: T. Weber (Office Vienna)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos company\n Europe | Asia | North America\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Together, We Create Change\n\nMoxa is committed to making a positive impact around the world. We put our all\nbehind this commitment--from our employees, to our products and supply chain.\n\nIn our local communities, we nurture and support the spirit of volunteering.\nWe encourage our employees to contribute to community development, with an\nemphasis on ecology, education, and health.\n\nIn our products, we invest in social awareness programs and\nenvironment-friendly policies at every stage of the product lifecycle. We make\nsure our manufacturing meets the highest standards with regards to quality,\nethics, and sustainability.\"\n\nSource: https://www.moxa.com/en/about-us/corporate-responsibility\n\nBusiness recommendation:\n------------------------\nSEC Consult recommends to immediately apply the available patches\nfrom the vendor. A thorough security review should be performed by\nsecurity professionals to identify further potential security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Authenticated Command Injection (CVE-2021-39279)\nAn authenticated command injection vulnerability can be triggered by issuing a\nGET request to the \"/forms/web_importTFTP\" CGI program which is available on\nthe web interface. An attacker can abuse this vulnerability to compromise the\noperating system of the device. This issue was found by emulating the firmware\nof the device.\n\n2) Reflected Cross-Site Scripting via Manipulated Config-File (CVE-2021-39278)\nVia a crafted config-file, a reflected cross-site scripting vulnerability can\nbe exploited in the context of the victim's browser. This config-file can be\nuploaded to the device via the \"Config Import Export\" tab in the main menu.\n\n3) Known GNU glibc Vulnerabilities (CVE-2015-0235)\nThe used GNU glibc in version 2.9 is outdated and contains multiple known\nvulnerabilities. One of the discovered vulnerabilities (CVE-2015-0235,\ngethostbyname \"GHOST\" buffer overflow) was verified by using the MEDUSA\nscalable firmware runtime.\n\n4) Multiple Outdated Software Components\nMultiple outdated software components containing vulnerabilities were found by\nthe IoT Inspector.\n\nThe vulnerabilities 1), 2) and 3) were manually verified on an emulated device\nby using the MEDUSA scalable firmware runtime.\n\nProof of concept:\n-----------------\n1) Authenticated Command Injection (CVE-2021-39279)\nThe vulnerability can be triggered by navigating in the web interface to the\ntab:\n\n\"Main Menu\"->\"Maintenance\"->\"Config Import Export\"\n\nThe \"TFTP Import\" menu is prone to command injection via all parameters. To\nexploit the vulnerability, an IP address, a configuration path and a filename\nmust be set.\nIf the filename is used to trigger the exploit, the payload in the interceptor\nproxy would be:\n\nhttp://192.168.1.1/forms/web_importTFTP?servIP=192.168.1.1&configPath=/&fileName=name|`ping localhost -c 100`\n\n\n2) Reflected Cross-Site Scripting via Manipulated Config-File (CVE-2021-39278)\nThe vulnerability can be triggered by navigating in the web interface to the\ntab:\n\n\"Main Menu\"->\"Maintenance\"->\"Config Import Export\"\n\nThe \"Config Import\" menu is prone to reflected cross-site scripting via the\nupload of config files. Example of malicious config file:\n-------------------------------------------------------------------------------\n[board]\ndeviceName=\"WAC-2004_0000</span><script>alert(document.cookie)</script>\"\ndeviceLocation=\"\"\n[..]\n-------------------------------------------------------------------------------\nUploading such a crafted file triggers cross-site scripting as the erroneous\nvalue is displayed without filtering characters.\n\n\n3) Known GNU glibc Vulnerabilities (CVE-2015-0235)\nGNU glibc version 2.9 contains multiple CVEs like:\nCVE-2016-1234, CVE-2015-7547, CVE-2013-7423, CVE-2013-1914, and more.\n\nThe gethostbyname buffer overflow vulnerability (GHOST) was checked with the\nhelp of the exploit code from https://seclists.org/oss-sec/2015/q1/274. It was\ncompiled and executed on the emulated device to test the system.\n\n\n4) Multiple Outdated Software Components\nThe IoT Inspector recognized multiple outdated software components with known\nvulnerabilities:\n\nBusyBox 1.18.5 06/2011\nDropbear SSH 2011.54 11/2011\nGNU glibc 2.9 02/2009\nLinux Kernel 2.6.27 10/2008\nOpenSSL 0.9.7g 04/2005\nOnly found in the program \"iw_director\"\nOpenSSL 1.0.0 03/2010\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following firmware versions for various devices have been identified\nto be vulnerable:\n* WAC-2004 / 1.7\n* WAC-1001 / 2.1\n* WAC-1001-T / 2.1\n* OnCell G3470A-LTE-EU / 1.7\n* OnCell G3470A-LTE-EU-T / 1.7\n* TAP-323-EU-CT-T / 1.3\n* TAP-323-US-CT-T / 1.3\n* TAP-323-JP-CT-T / 1.3\n* WDR-3124A-EU / 2.3\n* WDR-3124A-EU-T / 2.3\n* WDR-3124A-US / 2.3\n* WDR-3124A-US-T / 2.3\n\n\nVendor contact timeline:\n------------------------\n2020-10-09: Contacting vendor through [email\u00a0protected]\n2020-10-12: Contact sends PGP key for encrypted communication and asks for the\n detailed advisory. Sent encrypted advisory to vendor.\n2020-11-06: Status update from vendor regarding technical analysis. Vendor\n requested more time for fixing the vulnerabilities as more products\n are affected.\n2020-11-09: Granted more time for fixing to vendor.\n2020-11-10: Vendor asked for next steps regarding the advisory publication.\n2020-11-11: Asked vendor for an estimation when a public disclosure is possible.\n2020-11-16: Vendor responded that the product team can give a rough feedback.\n2020-11-25: Asked for a status update.\n2020-11-25: Vendor responded that the investigation is not done yet.\n2020-12-14: Vendor provided a list of potential affected devices and stated\n that full investigation may take until January 2021 due to the list\n of CVEs that were provided with the appended IoT Inspector report.\n The patches may be available until June 2021.\n2020-12-15: Shifted next status update round with vendor on May 2021.\n2020-12-23: Vendor provided full list of affected devices.\n2021-02-05: Vendor sieved out the found issues from 4) manually and provided a\n full list of confirmed vulnerabilities. WAC-2004 phased-out in\n 2019.\n2021-02-21: Confirmed receive of vulnerabilities, next status update in May\n 2021.\n2021-06-10: Asking for an update.\n2021-06-15: Vendor stated, that the update will be provided in the next days.\n2021-06-21: Vendor will give an update in the next week as Covid gets worse in\n Taiwan.\n2021-06-23: Vendor stated, that patches are under development. Vendor needs more\n time to finish the patches.\n2021-06-24: Set release date to 2021-09-01.\n2021-07-02: Vendor provides status updates.\n2021-08-16: Vendor provides status updates.\n2021-08-17: Vendor asks for CVE IDs and stated, that WDR-3124A has phased-out.\n2021-08-20: Sent assigned CVE-IDs to vendor. Asked for fixed version numbers.\n2021-08-31: Vendor provides fixed firmware version numbers and the advisory\n links.\n2021-09-01: Coordinated release of security advisory.\n\nSolution:\n---------\nAccording to the vendor the following patches must be applied to fix issues:\n* WAC-1001 / 2.1.5\n* WAC-1001-T / 2.1.5\n* OnCell G3470A-LTE-EU / 1.7.4\n* OnCell G3470A-LTE-EU-T / 1.7.4\n* TAP-323-EU-CT-T / 1.8.1\n* TAP-323-US-CT-T / 1.8.1\n* TAP-323-JP-CT-T / 1.8.1\n\nThe Moxa Technical Support must be contacted for requesting the security\npatches.\n\nThe corresponding security advisories for the affected devices are available on\nthe vendor's website:\nTAP-323/WAC-1001/WAC-2004\nhttps://www.moxa.com/en/support/product-support/security-advisory/tap-323-wac-1001-2004-wireless-ap-bridge-client-vulnerabilities\nOnCell G3470A-LTE/WDR-3124A\nhttps://www.moxa.com/en/support/product-support/security-advisory/oncell-g3470a-wdr-3124a-cellular-gateways-router-vulnerabilities\n\nThe following device models are EOL and should be replaced:\n* WAC-2004\n* WDR-3124A-EU\n* WDR-3124A-EU-T\n* WDR-3124A-US\n* WDR-3124A-US-T\n", "sourceHref": "https://0day.today/exploit/36699", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "packetstorm": [{"lastseen": "2021-09-01T16:00:43", "description": "", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2021-09-01T00:00:00", "type": "packetstorm", "title": "Moxa Command Injection / Cross Site Scripting / Vulnerable Software", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-1914", "CVE-2013-7423", "CVE-2015-0235", "CVE-2015-7547", "CVE-2016-1234", "CVE-2021-39278", "CVE-2021-39279"], "modified": "2021-09-01T00:00:00", "id": "PACKETSTORM:164014", "href": "https://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html", "sourceData": "`SEC Consult Vulnerability Lab Security Advisory < 20210901-0 > \n======================================================================= \ntitle: Multiple vulnerabilities \nproduct: see \"Vulnerable / tested versions\" \nvulnerable version: see \"Vulnerable / tested versions\" \nfixed version: see \"Solution\" \nCVE number: CVE-2021-39278, CVE-2021-39279 \nimpact: High \nhomepage: https://www.moxa.com/ \nfound: 2020-08-31 \nby: T. Weber (Office Vienna) \nSEC Consult Vulnerability Lab \n \nAn integrated part of SEC Consult, an Atos company \nEurope | Asia | North America \n \nhttps://www.sec-consult.com \n \n======================================================================= \n \nVendor description: \n------------------- \n\"Together, We Create Change \n \nMoxa is committed to making a positive impact around the world. We put our all \nbehind this commitment--from our employees, to our products and supply chain. \n \nIn our local communities, we nurture and support the spirit of volunteering. \nWe encourage our employees to contribute to community development, with an \nemphasis on ecology, education, and health. \n \nIn our products, we invest in social awareness programs and \nenvironment-friendly policies at every stage of the product lifecycle. We make \nsure our manufacturing meets the highest standards with regards to quality, \nethics, and sustainability.\" \n \nSource: https://www.moxa.com/en/about-us/corporate-responsibility \n \nBusiness recommendation: \n------------------------ \nSEC Consult recommends to immediately apply the available patches \nfrom the vendor. A thorough security review should be performed by \nsecurity professionals to identify further potential security issues. \n \n \nVulnerability overview/description: \n----------------------------------- \n1) Authenticated Command Injection (CVE-2021-39279) \nAn authenticated command injection vulnerability can be triggered by issuing a \nGET request to the \"/forms/web_importTFTP\" CGI program which is available on \nthe web interface. An attacker can abuse this vulnerability to compromise the \noperating system of the device. This issue was found by emulating the firmware \nof the device. \n \n2) Reflected Cross-Site Scripting via Manipulated Config-File (CVE-2021-39278) \nVia a crafted config-file, a reflected cross-site scripting vulnerability can \nbe exploited in the context of the victim's browser. This config-file can be \nuploaded to the device via the \"Config Import Export\" tab in the main menu. \n \n3) Known GNU glibc Vulnerabilities (CVE-2015-0235) \nThe used GNU glibc in version 2.9 is outdated and contains multiple known \nvulnerabilities. One of the discovered vulnerabilities (CVE-2015-0235, \ngethostbyname \"GHOST\" buffer overflow) was verified by using the MEDUSA \nscalable firmware runtime. \n \n4) Multiple Outdated Software Components \nMultiple outdated software components containing vulnerabilities were found by \nthe IoT Inspector. \n \nThe vulnerabilities 1), 2) and 3) were manually verified on an emulated device \nby using the MEDUSA scalable firmware runtime. \n \nProof of concept: \n----------------- \n1) Authenticated Command Injection (CVE-2021-39279) \nThe vulnerability can be triggered by navigating in the web interface to the \ntab: \n \n\"Main Menu\"->\"Maintenance\"->\"Config Import Export\" \n \nThe \"TFTP Import\" menu is prone to command injection via all parameters. To \nexploit the vulnerability, an IP address, a configuration path and a filename \nmust be set. \nIf the filename is used to trigger the exploit, the payload in the interceptor \nproxy would be: \n \nhttp://192.168.1.1/forms/web_importTFTP?servIP=192.168.1.1&configPath=/&fileName=name|`ping localhost -c 100` \n \n \n2) Reflected Cross-Site Scripting via Manipulated Config-File (CVE-2021-39278) \nThe vulnerability can be triggered by navigating in the web interface to the \ntab: \n \n\"Main Menu\"->\"Maintenance\"->\"Config Import Export\" \n \nThe \"Config Import\" menu is prone to reflected cross-site scripting via the \nupload of config files. Example of malicious config file: \n------------------------------------------------------------------------------- \n[board] \ndeviceName=\"WAC-2004_0000</span><script>alert(document.cookie)</script>\" \ndeviceLocation=\"\" \n[..] \n------------------------------------------------------------------------------- \nUploading such a crafted file triggers cross-site scripting as the erroneous \nvalue is displayed without filtering characters. \n \n \n3) Known GNU glibc Vulnerabilities (CVE-2015-0235) \nGNU glibc version 2.9 contains multiple CVEs like: \nCVE-2016-1234, CVE-2015-7547, CVE-2013-7423, CVE-2013-1914, and more. \n \nThe gethostbyname buffer overflow vulnerability (GHOST) was checked with the \nhelp of the exploit code from https://seclists.org/oss-sec/2015/q1/274. It was \ncompiled and executed on the emulated device to test the system. \n \n \n4) Multiple Outdated Software Components \nThe IoT Inspector recognized multiple outdated software components with known \nvulnerabilities: \n \nBusyBox 1.18.5 06/2011 \nDropbear SSH 2011.54 11/2011 \nGNU glibc 2.9 02/2009 \nLinux Kernel 2.6.27 10/2008 \nOpenSSL 0.9.7g 04/2005 \nOnly found in the program \"iw_director\" \nOpenSSL 1.0.0 03/2010 \n \n \nVulnerable / tested versions: \n----------------------------- \nThe following firmware versions for various devices have been identified \nto be vulnerable: \n* WAC-2004 / 1.7 \n* WAC-1001 / 2.1 \n* WAC-1001-T / 2.1 \n* OnCell G3470A-LTE-EU / 1.7 \n* OnCell G3470A-LTE-EU-T / 1.7 \n* TAP-323-EU-CT-T / 1.3 \n* TAP-323-US-CT-T / 1.3 \n* TAP-323-JP-CT-T / 1.3 \n* WDR-3124A-EU / 2.3 \n* WDR-3124A-EU-T / 2.3 \n* WDR-3124A-US / 2.3 \n* WDR-3124A-US-T / 2.3 \n \n \nVendor contact timeline: \n------------------------ \n2020-10-09: Contacting vendor through moxa.csrt@moxa.com. \n2020-10-12: Contact sends PGP key for encrypted communication and asks for the \ndetailed advisory. Sent encrypted advisory to vendor. \n2020-11-06: Status update from vendor regarding technical analysis. Vendor \nrequested more time for fixing the vulnerabilities as more products \nare affected. \n2020-11-09: Granted more time for fixing to vendor. \n2020-11-10: Vendor asked for next steps regarding the advisory publication. \n2020-11-11: Asked vendor for an estimation when a public disclosure is possible. \n2020-11-16: Vendor responded that the product team can give a rough feedback. \n2020-11-25: Asked for a status update. \n2020-11-25: Vendor responded that the investigation is not done yet. \n2020-12-14: Vendor provided a list of potential affected devices and stated \nthat full investigation may take until January 2021 due to the list \nof CVEs that were provided with the appended IoT Inspector report. \nThe patches may be available until June 2021. \n2020-12-15: Shifted next status update round with vendor on May 2021. \n2020-12-23: Vendor provided full list of affected devices. \n2021-02-05: Vendor sieved out the found issues from 4) manually and provided a \nfull list of confirmed vulnerabilities. WAC-2004 phased-out in \n2019. \n2021-02-21: Confirmed receive of vulnerabilities, next status update in May \n2021. \n2021-06-10: Asking for an update. \n2021-06-15: Vendor stated, that the update will be provided in the next days. \n2021-06-21: Vendor will give an update in the next week as Covid gets worse in \nTaiwan. \n2021-06-23: Vendor stated, that patches are under development. Vendor needs more \ntime to finish the patches. \n2021-06-24: Set release date to 2021-09-01. \n2021-07-02: Vendor provides status updates. \n2021-08-16: Vendor provides status updates. \n2021-08-17: Vendor asks for CVE IDs and stated, that WDR-3124A has phased-out. \n2021-08-20: Sent assigned CVE-IDs to vendor. Asked for fixed version numbers. \n2021-08-31: Vendor provides fixed firmware version numbers and the advisory \nlinks. \n2021-09-01: Coordinated release of security advisory. \n \nSolution: \n--------- \nAccording to the vendor the following patches must be applied to fix issues: \n* WAC-1001 / 2.1.5 \n* WAC-1001-T / 2.1.5 \n* OnCell G3470A-LTE-EU / 1.7.4 \n* OnCell G3470A-LTE-EU-T / 1.7.4 \n* TAP-323-EU-CT-T / 1.8.1 \n* TAP-323-US-CT-T / 1.8.1 \n* TAP-323-JP-CT-T / 1.8.1 \n \nThe Moxa Technical Support must be contacted for requesting the security \npatches. \n \nThe corresponding security advisories for the affected devices are available on \nthe vendor's website: \nTAP-323/WAC-1001/WAC-2004 \nhttps://www.moxa.com/en/support/product-support/security-advisory/tap-323-wac-1001-2004-wireless-ap-bridge-client-vulnerabilities \nOnCell G3470A-LTE/WDR-3124A \nhttps://www.moxa.com/en/support/product-support/security-advisory/oncell-g3470a-wdr-3124a-cellular-gateways-router-vulnerabilities \n \nThe following device models are EOL and should be replaced: \n* WAC-2004 \n* WDR-3124A-EU \n* WDR-3124A-EU-T \n* WDR-3124A-US \n* WDR-3124A-US-T \n \n \nWorkaround: \n----------- \nNone. \n \n \nAdvisory URL: \n------------- \nhttps://sec-consult.com/vulnerability-lab/ \n \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nSEC Consult Vulnerability Lab \n \nSEC Consult, an Atos company \nEurope | Asia | North America \n \nAbout SEC Consult Vulnerability Lab \nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an \nAtos company. It ensures the continued knowledge gain of SEC Consult in the \nfield of network and application security to stay ahead of the attacker. The \nSEC Consult Vulnerability Lab supports high-quality penetration testing and \nthe evaluation of new offensive and defensive technologies for our customers. \nHence our customers obtain the most current information about vulnerabilities \nand valid recommendation about the risk profile of new technologies. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \nInterested to work with the experts of SEC Consult? \nSend us your application https://sec-consult.com/career/ \n \nInterested in improving your cyber security with the experts of SEC Consult? \nContact our local offices https://sec-consult.com/contact/ \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nMail: research at sec-consult dot com \nWeb: https://www.sec-consult.com \nBlog: http://blog.sec-consult.com \nTwitter: https://twitter.com/sec_consult \n \nEOF Thomas Weber / @2021 \n \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/164014/SA-20210901-0.txt", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}