CVE-2021-39279

🗓️ 07 Sep 2021 05:40:14Reported by mitreType

cve🔗 web.nvd.nist.gov👁 128 Views🌐 WEB

Certain MOXA devices Authenticated Command Injection via /forms/web_importTFTP. Affected models: WAC-2004 1.7, WAC-1001 2.1, WDR-3124A-US-T 2.3

Reporter	Title	Published	Views	Family All 15
zdt	Moxa Command Injection / Cross Site Scripting Vulnerabilities	1 Sep 202100:00	–	zdt
attackerkb	CVE-2021-39279	7 Sep 202106:15	–	attackerkb
BDU FSTEC	The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series and WDR-3124A Series, as well as in microprogrammed software for Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series, arises from the lack of measures taken to neutralize special elements used in operating systems. This allows attackers to enhance their privileges.	1 Sep 202100:00	–	bdu_fstec
Circl	CVE-2021-39279	21 Sep 202104:41	–	circl
CNNVD	Moxa 多款产品操作系统命令注入漏洞	1 Sep 202100:00	–	cnnvd
Check Point Advisories	Moxa Multiple Products Command Injection (CVE-2021-39279)	29 Sep 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-39279	7 Sep 202105:40	–	cvelist
EUVD	EUVD-2021-25641	7 Oct 202500:30	–	euvd
NVD	CVE-2021-39279	7 Sep 202106:15	–	nvd
OSV	CVE-2021-39279	7 Sep 202106:15	–	osv

NVD

Node

AND

moxa wac-2004_firmwareMatch1.7

moxa wac-2004Match-

Node

AND

moxa wac-1001_firmwareMatch2.1

moxa wac-1001Match-

Node

AND

moxa wac-1001-t_firmwareMatch2.1

moxa wac-1001-tMatch-

Node

AND

moxa oncell_g3470a-lte-eu_firmwareMatch1.7

moxa oncell_g3470a-lte-euMatch-

Node

AND

moxa oncell_g3470a-lte-eu-t_firmwareMatch1.7

moxa oncell_g3470a-lte-eu-tMatch-

Node

AND

moxa tap-323-eu-ct-t_firmwareMatch1.3

moxa tap-323-eu-ct-tMatch-

Node

AND

moxa tap-323-us-ct-t_firmwareMatch1.3

moxa tap-323-us-ct-tMatch-

Node

AND

moxa tap-323-jp-ct-t_firmwareMatch1.3

moxa tap-323-jp-ct-tMatch-

Node

AND

moxa wdr-3124a-eu_firmwareMatch2.3

moxa wdr-3124a-euMatch-

Node

AND

moxa wdr-3124a-eu-t_firmwareMatch2.3

moxa wdr-3124a-eu-tMatch-

Node

AND

moxa wdr-3124a-us_firmwareMatch2.3

moxa wdr-3124a-usMatch-

Node

AND

moxa wdr-3124a-us-t_firmwareMatch2.3

moxa wdr-3124a-us-tMatch-

Source	Link
moxa	www.moxa.com/
packetstormsecurity	www.packetstormsecurity.com/files/164014

Parameter	Position	Path	Description	CWE
servIP	query param	/forms/web_importTFTP?servIP=192.168.1.1&configPath=/&fileName=name\|`ping localhost -c 100`	Authenticated command injection via GET request to /forms/web_importTFTP; payload can be injected through query parameters (e.g., fileName).	CWE-78
configPath	query param	/forms/web_importTFTP?servIP=192.168.1.1&configPath=/&fileName=name\|`ping localhost -c 100`	Authenticated command injection via GET request to /forms/web_importTFTP; payload can be injected through query parameters (e.g., fileName).	CWE-78
fileName	query param	/forms/web_importTFTP?servIP=192.168.1.1&configPath=/&fileName=name\|`ping localhost -c 100`	Authenticated command injection via GET request to /forms/web_importTFTP; payload can be injected through query parameters (e.g., fileName).	CWE-78

17 Jun 2026 04:03Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

CVSS 29

EPSS0.04613

CWE-78