CVE-2019-5142

CVE-2019-5142 affects the Moxa AWK-3131A Series (firmware v1.13). The vulnerability is an OS command injection in the WAP hostname handling: a specially crafted entry to network configuration information can cause arbitrary system commands to execute, giving an attacker full control of the device...

CVE-2019-5142

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

CVE-2019-5141

CVE-2019-5141 affects Moxa AWK-3131A, firmware 1.13. An exploitable OS command injection in the iw_webs function via the iw_serverip parameter allows an authenticated, low-privilege user to trigger remote control over the device. The root cause involves user input being reflected in a subsequent ...

CVE-2019-5141

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can...

CVE-2019-5140

CVE-2019-5140 affects Moxa AWK-3131A firmware v1.13 (and prior per advisories). An OS command injection flaw in the iw_webs/diagnostic script handling allows a low-privilege authenticated user to inject commands via a crafted diagnostic script file name, leading to remote control of the device. T...

CVE-2019-5140

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attack...

Moxa AWK-3131A Buffer Overflow Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. A buffer overflow vulnerability exists in the iwwebs configuration parsing function in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to execute code...

CVE-2019-5148: Out-of-bounds Read

An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packe...

Moxa AWK-3131A ServiceAgent Trust Management Issue Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. A trust management issue vulnerability exists in the ServiceAgent binary in the Moxa AWK-3131A using firmware version 1.13. An attacker could exploit this vulnerability to decrypt captured traffic...

CVE-2019-5139: Use of Hard-coded Credentials

An exploitable use of hard-coded credentials vulnerability exists in multiple iw utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts...

CVE-2019-5141: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can...

CVE-2019-5143: Buffer Copy without Checking Size of Input

An exploitable format string vulnerability exists in the iwconsole coniowritestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands whil...

Moxa AWK-3131A iw_webs Account Settings Function Access Control Error Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. An access control error vulnerability exists in the iwwebs account settings feature in the Moxa AWK-3131A using firmware version 1.13. The vulnerability arises from the network system or product not properly restricting access to resources fro...

Moxa AWK-3131A iw_webs Function Operating System Command Injection Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. An operating system command injection vulnerability exists in the iwwebs function in the Moxa AWK-3131A using firmware version 1.13. The vulnerability stems from a network system or product not properly filtering special characters, commands,...

Moxa AWK-3131A Access Control Error Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. An access control error vulnerability exists in the 'iwconsole' function in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to gain access to the system as root with the help of a menu selection strin...

CVE-2019-5140: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attack...

CVE-2019-5142: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

Moxa AWK-3131A Operating System Command Injection Vulnerability (CNVD-2020-13481)

Moxa AWK-3131A is a wireless access device from Moxa. An operating system command injection vulnerability exists in the 'Device Name' in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to execute arbitrary system commands to take control of the device...

CVE-2019-5162: Improper Access Control

An exploitable improper access control vulnerability exists in the iwwebs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as...

CVE-2019-5138: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker...