description: An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various authenticated requests to trigger this vulnerability.
problem types: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
product: Moxa
vendor: n/a
versions:
status: affected, version: Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client version 1.13
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]