CVE-2018-10699

CVE-2018-10699 affects Moxa AWK-3121, version 1.14. The vulnerability stems from the certfile upload functionality; the POST parameter iw_privatePass is susceptible to command injection. An attacker crafting input with shell metacharacters could execute arbitrary commands on the device, potential...

CVE-2018-10695

CVE-2018-10695 affects Moxa AWK-3121 devices (version 1.14). The vulnerability arises from a buffer overflow in the device’s alert functionality used to email administrators about network changes; crafting a packet containing a 678-character string can lead to arbitrary command execution on the d...

CVE-2018-10697

The CVE-2018-10697 entry affects Moxa AWK-3121 (firmware 1.14). The vulnerability is a command injection in the POST parameter srvName exposed via the device’s ping functionality, allowing an attacker to craft input with shell metacharacters and execute commands on the device. Reported as impacti...

CVE-2018-10694

The CVE-2018-10694 issue affects Moxa AWK-3121 (version 1.14). The root cause is an open, unencrypted Wi‑Fi setup by default, enabling an attacker on the same network to sniff traffic between a user’s computer and the device, potentially stealing credentials over HTTP and TELNET, and performing M...

CVE-2018-10691

The CVE-2018-10691 issue affects Moxa AWK-3121 devices (version 1.14) and is caused by Improper Access Control, allowing an unauthenticated user to download /systemlog.log (system log) via the device web interface. Public sources (NVD, CISA/ICS advisory, CNVD) confirm the vulnerability and its im...

CVE-2018-10696

The CVE-2018-10696 entry applies to Moxa AWK-3121 devices (firmware 1.14). The issue is a Cross‑Site Request Forgery (CSRF) vulnerability in the device’s web interface, which can allow an attacker to trick an administrator into performing actions via the affected URI forms (e.g., forms/iw_webSetP...

CVE-2018-10692

The CVE-2018-10692 issue affects Moxa AWK-3121 devices (version 1.14) where the session cookie Password508 is not HttpOnly, enabling a cross-site scripting attacker to steal the cookie. Connected sources (NVD, CISA/ICS advisory, and Nessus plugin) confirm this vulnerability is tied to the HTTP co...

CVE-2018-10698

CVE-2018-10698 affects Moxa AWK-3121 v1.14. The device enables an unencrypted TELNET service by default, allowing an attacker with MITM access to sniff traffic and connect to the TELNET daemon using default credentials if unchanged. The issue is documented with a high-severity CVSS score (3.1: 9....

CVE-2018-10701

The CVE-2018-10701 issue affects Moxa AWK-3121 (version 1.14). The POST parameter iw_filename is vulnerable to a buffer overflow when a 162-character string is crafted, which can allow an attacker to execute commands on the device. Public documents consistently describe this as a memory-buffer–re...

CVE-2018-10690

The CVE-2018-10690 entry concerns Moxa AWK-3121 (version 1.14) where the device defaults to HTTP, enabling cleartext transmission of sensitive information. Multiple connected sources confirm the vulnerability is due to insecure web traffic allowing an attacker to sniff credentials and other data....

CVE-2018-10693

CVE-2018-10693 affects Moxa AWK-3121 (version 1.14). The vulnerability is a buffer overflow in the srvName POST parameter within the device’s ping/diagnostic capability, where craft­ing a string of 516 characters can allow an attacker to execute arbitrary commands on the device. Multiple connecte...

CVE-2018-10702

CVE-2018-10702 affects Moxa AWK-3121 (version 1.14) and involves a command-injection vulnerability in the device’s script-running functionality. The POST parameter "iw_filename" can be abused to inject shell commands, enabling an attacker to execute commands on the device via this feature. Public...

CVE-2018-10700

CVE-2018-10700 affects Moxa AWK-3121 (version 1.19). The vulnerability arises in the web interface via the POST parameter iw_board_deviceName, allowing an attacker to inject a payload and execute cross-site scripting (XSS). The issue is tied to an input handling flaw in the device name change fun...

CVE-2018-10703

The CVE-2018-10703 entry affects Moxa AWK-3121 devices (version 1.14). The vulnerability is a buffer overflow in the iw_serverip POST parameter used by the device’s script-runner/troubleshooting functionality, which an attacker can exploit by sending a crafted packet containing 480 characters to ...