CVE-2018-10693: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is...

CVE-2018-10695: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST...

CVE-2018-10698: Missing Encryption of Sensitive Data

An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET...

CVE-2018-10702: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iwfilename" is susceptible ...

Denial Of Service (DoS)

file is vulnerable to denial of service DoS attacks. The vulnerability exists as file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking duri...

Awk to Perl 1.007-5 - Buffer Overflow (PoC)

Exploit Title: Awk to Perl 1.007-5 - Buffer Overflow PoC Author: Todor Donev Date: 2018-07-11 Software: Linux Awk to Perl Translator '/usr/bin/a2p' Version: 1.007-5 CVE: N/A Tested on: CentOS 6.9, Ubuntu 10 todor@adamantium $ python -c "print 'A' 2070" | a2p /dev/null Segmentation fault...

Awk to Perl 1.007-5 - Buffer Overflow (PoC)

Awk to Perl 1.007-5 - Buffer Overflow PoC Exploit Title: Awk to Perl 1.007-5 - Buffer Overflow PoC Author: Todor Donev Date: 2018-07-11 Software: Linux Awk to Perl Translator '/usr/bin/a2p' Version: 1.007-5 CVE: N/A Tested on: CentOS 6.9, Ubuntu 10 todor@adamantium $ python -c "print 'A' 2070" |...

Linux Awk To Perl Translator Buffer Overflow

Linux Awk to Perl translator /usr/bin/a2p Buffer Overflow PoC Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Disclaimer: This or previous programs is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies,...

Moxa AWK-3131A Operating System Command Injection Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. An operating system command injection vulnerability exists in the Telnet, SSH, and console login functions of the Moxa AWK-3131A using firmware versions 1.4 through 1.7. A remote attacker can exploit this vulnerability to execute root OS...

The vulnerability of the registration and accounting subsystem of the wireless access point for Moxa AWK-3131A industrial systems allows a intruder to execute arbitrary commands with root privileges.

The vulnerability of the registration and accounting subsystem of the wireless access point for Moxa AWK-3131A industrial systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious act...

Command injection

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

CVE-2017-14459

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

CVE-2017-14459

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

CVE-2017-14459

CVE-2017-14459 affects the Moxa AWK-3131A industrial Wi‑Fi AP/bridge/client. The vulnerability is an OS command injection via the username parameter in Telnet, SSH and the local console login, allowing remote, unauthenticated, root‑level command execution. Root cause is tied to BusyBox loginutils...

CVE-2017-14459: Improper Neutralization of Special Elements used in an OS Command

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

Moxa AWK-3131A Wireless Access Point Hardcoded Administrator Certificate Vulnerability

The Moxa AWK-3131A Wireless Access Point is a wireless switch from Moxa. A security vulnerability exists in the Moxa AWK-3131A Wireless Access Point using firmware version 1.1, which originates from the use of hard-coded credentials by a root account. An attacker could use the vulnerability to ta...

Moxa AWK-3131A 1.4 < 1.7 - Username OS Command Injection Exploit

Exploit for hardware platform in category remote exploits !/usr/bin/env python2 import telnetlib import re import random import string Split string into chunks, of which each is /var/a' - 1 completed = temp = re.split'\n', script for content in temp: if lencontent != 0: for s in re.split' ',...

Vulnerability Spotlight: Moxa AWK-3131A Multiple Features Login Username Parameter OS Command Injection Vulnerability

This vulnerability is discovered by Patrick DeSantis and Dave McDaniel of Cisco Talos Today, Talos is disclosing TALOS-2017-0507 CVE-2017-14459, a vulnerability that has been identified in Moxa AWK-3131A industrial wireless access point. The Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless...

Moxa AWK-3131A Multiple Features Login Username Parameter OS Command Injection Vulnerability

Summary An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of...

CVE-2016-8717

An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system contains an undocumented, privileged root account with hard-coded credentials, giving attackers full control of affected devices...