Talos Moxa
En bref
- Source
- NVD
- EPSS
- EPSS 12.64 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- talos
- Statut NVD
- Modified
Description
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | talos |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · talos-cna@cisco.com (Secondary) |
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-5962
- GCVE · GCVE-0-2017-14459
Avis du CERT-FR
- CERTFR-2018-AVI-173 — Multiples vulnérabilités dans SCADA les produits Moxa · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:moxa:awk-3131a_firmware:1.4:*:*:*:*:*:*:*cpe:2.3:o:moxa:awk-3131a_firmware:1.5:*:*:*:*:*:*:*cpe:2.3:o:moxa:awk-3131a_firmware:1.6:*:*:*:*:*:*:*cpe:2.3:o:moxa:awk-3131a_firmware:1.7:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Talos · Moxa | affected Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client versions 1.4 - 1.9. In addition, versions prior to 1.4 appear similarly vulnerable to injection, but not as easily exploitable (described below). Other models in the AWK product line may likewise be vulnerable but have not been tested. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |