critical10.0Public exploit code
CVE-2017-14459
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Moxa AWK-3131A 1.4 < 1.7 - 'Username' OS Command Injection2017-04-03 · remote · hardware
Impact
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moxa | Awk-3131a Firmware | Versions 1.4, 1.5, 1.6, 1.7 |