CVE-2017-14459 An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versi...
CriticalCVSS 9.8
EPSS 12.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Moxa awk-3131a firmware | = 1.4 | No fix listed |
| Moxa awk-3131a firmware | = 1.5 | No fix listed |
| Moxa awk-3131a firmware | = 1.6 | No fix listed |
| Moxa awk-3131a firmware | = 1.7 | No fix listed |
| Talos Moxa | = Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client versions 1.4 - 1.9. In addition, versions prior to 1.4 appear similarly vulnerable to injection, but not as easily explo | No fix listed |
References
- talosintelligence.com third-party-advisory