PT-2017-9763 · Moxa · Moxa Awk-3131A Wireless Access Point

Name of the Vulnerable Software and Affected Versions: Moxa AWK-3131A Wireless Access Points version 1.1 Description: An exploitable OS Command Injection issue exists in the web application 'ping' functionality. Specially crafted web form input can cause an OS Command Injection, resulting in...

Information disclosure

An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker...

CVE-2016-8722

An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. Retrieving a specific URL without authentication can reveal sensitive information to an attacker...

CVE-2016-8727

An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker...

CVE-2016-8727

An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker...

Information disclosure

An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information...

Null pointer dereference

An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server...

CVE-2016-8723

An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...

Design/Logic Flaw

An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location header of the HTTP...

CVE-2016-8720

An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location header of the HTTP...

Information disclosure

An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker...

CVE-2016-8723

An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...

CVE-2016-8725

CVE-2016-8725 affects Moxa AWK-3131A wireless access point (firmware 1.1). A vulnerability in the Web Application allows information disclosure by retrieving a protected URL (e.g., systemlog.log) without authentication. Public sources (Talos, Seebug, OpenVAS plugin, CVE entries) describe a PoC us...

CVE-2016-8720

An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location header of the HTTP...

CVE-2016-8723

CVE-2016-8723 affects Moxa AWK-3131A Wireless Access Point (firmware 1.1). A null pointer dereference in the Web Application can be triggered by HTTP GET requests not starting with ‘/’, causing the web server to segfault (Denial of Service). Reported CVSS around 7.5 (HIGH). Exploitation details e...

CVE-2016-8724

Affected product: Moxa AWK-3131A Wireless Access Point (firmware 1.1). Vulnerability: serviceAgent information disclosure via a crafted TCP query, enabling an attacker to retrieve sensitive device information. Root cause / details: unauthenticated, cleartext communication exposed by the serviceAg...

CVE-2016-8727

The CVE-2016-8727 issue affects Moxa AWK-3131A Wireless Access Point web application functionality. It describes an information-disclosure vulnerability where retrieving a series of URLs without authentication can reveal sensitive configuration and system data. The vulnerability is network-expose...

CVE-2016-8727

An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker...

CVE-2016-8726

Summary of CVE-2016-8726 : Affected product is the Moxa AWK-3131A Wireless Access Point (firmware 1.1). The issue is a null pointer dereference in the Web Application’s /forms/web_runScript iw_filename function. An HTTP POST containing a blank line in the header can trigger a segmentation fault i...

CVE-2016-8725

An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker...