CVE-2018-10703

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.60%

Published

Jun 7, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack.

Weaknesses (CWE)

CWE-119

Affected Products (2)

moxa · awk-3121_firmwarevulnerable

moxa · awk-3121

References (6)

http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html

https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121

ExploitThird Party Advisory

https://seclists.org/bugtraq/2019/Jun/8

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html

https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs