CVE-2016-8721

An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device. An attacker can exploit this vulnerability remotely.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v3.0

9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

3.28% chance of exploitation in the next 30 days, 88th percentile

Published

2017-04-20

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.talosintelligence.com/reports/TALOS-2016-0235/

References

• CVE Record
• NVD entry

Related

• CVE-2016-8720
• CVE-2016-8722
• CVE-2016-8719
• CVE-2016-8723
• CVE-2016-8718
• CVE-2016-8724