← Back

CVE-2017-14459

nvd nist
Published: Apr 11, 2018Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.

Affected (4)

Moxa
1 product
Awk 3131a Firmware
Configuration A
4 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Moxa
Awk 3131a Firmware
Version 1.4
Awk 3131a Firmware
Version 1.5
Awk 3131a Firmware
Version 1.6
Awk 3131a Firmware
Version 1.7
Running on/withPlatform Versions
Moxa
Awk 3131a
All versions

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

Source: talos-cna@cisco.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.