CVE-2017-14459

critical · 10

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.

CVSS

12.6%

EPSS (exploit prob.)

96th

EPSS percentile

2018-04-11

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
moxa	awk-3131a_firmware	1.4
moxa	awk-3131a_firmware	1.5
moxa	awk-3131a_firmware	1.6
moxa	awk-3131a_firmware	1.7
moxa	awk-3131a	all versions

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2017-0507
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0507

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-14459