CVE-2017-14459

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

10.0 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

12.64% chance of exploitation in the next 30 days, 96th percentile

Published

2018-04-11

Updated

2024-09-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44398

References

• CVE Record
• NVD entry

Related

• CVE-2017-14458
• CVE-2017-14460
• CVE-2017-14452
• CVE-2017-14462
• CVE-2017-14451
• CVE-2017-14463