Sign-up

ID

VAR-201804-0372


CVE

CVE-2017-14459


TITLE

Moxa AWK-3131A Operating System Command Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2018-10105 // CNNVD: CNNVD-201709-609

DESCRIPTION

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution. Moxa AWK-3131A Is OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MoxaAWK-3131A is a wireless access device from Moxa

Trust: 2.34

sources: NVD: CVE-2017-14459 // JVNDB: JVNDB-2017-013280 // CNVD: CNVD-2018-10105 // VULHUB: VHN-105183 // VULMON: CVE-2017-14459

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-10105

AFFECTED PRODUCTS

vendor:moxamodel:awk-3131ascope:eqversion:1.7

Trust: 1.6

vendor:moxamodel:awk-3131ascope:eqversion:1.6

Trust: 1.6

vendor:moxamodel:awk-3131ascope:eqversion:1.5

Trust: 1.6

vendor:moxamodel:awk-3131ascope:eqversion:1.4

Trust: 1.6

vendor:moxamodel:awk-3131ascope:eqversion:1.4 to 1.7

Trust: 0.8

vendor:moxamodel:awk-3131ascope:gteversion:1.4<=1.7

Trust: 0.6

sources: CNVD: CNVD-2018-10105 // JVNDB: JVNDB-2017-013280 // CNNVD: CNNVD-201709-609 // NVD: CVE-2017-14459

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-14459
value: CRITICAL

Trust: 1.0

talos-cna@cisco.com: CVE-2017-14459
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-14459
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-10105
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201709-609
value: CRITICAL

Trust: 0.6

VULHUB: VHN-105183
value: HIGH

Trust: 0.1

VULMON: CVE-2017-14459
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-14459
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-10105
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-105183
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-14459
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

talos-cna@cisco.com: CVE-2017-14459
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2018-10105 // VULHUB: VHN-105183 // VULMON: CVE-2017-14459 // JVNDB: JVNDB-2017-013280 // CNNVD: CNNVD-201709-609 // NVD: CVE-2017-14459 // NVD: CVE-2017-14459

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-105183 // JVNDB: JVNDB-2017-013280 // NVD: CVE-2017-14459

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-609

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201709-609

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-013280

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-105183

PATCH
title:AWK-3131A シリーズurl:https://japan.moxa.com/product/AWK-3131A.htm
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-013280

EXTERNAL IDS
db:NVDid:CVE-2017-14459
Trust: 3.2
db:TALOSid:TALOS-2017-0507
Trust: 3.2
db:JVNDBid:JVNDB-2017-013280
Trust: 0.8
db:CNNVDid:CNNVD-201709-609
Trust: 0.7
db:CNVDid:CNVD-2018-10105
Trust: 0.6
db:EXPLOIT-DBid:44398
Trust: 0.1
db:VULHUBid:VHN-105183
Trust: 0.1
db:VULMONid:CVE-2017-14459
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-10105 // 
            
            
            
            VULHUB: VHN-105183 // 
            
            
            
            VULMON: CVE-2017-14459 // 
            
            
            
            JVNDB: JVNDB-2017-013280 // 
            
            
            
            CNNVD: CNNVD-201709-609 // 
            
            
            
            NVD: CVE-2017-14459

REFERENCES
url:https://talosintelligence.com/vulnerability_reports/talos-2017-0507
Trust: 3.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14459
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-14459
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-10105 // 
            
            
            
            VULHUB: VHN-105183 // 
            
            
            
            VULMON: CVE-2017-14459 // 
            
            
            
            JVNDB: JVNDB-2017-013280 // 
            
            
            
            CNNVD: CNNVD-201709-609 // 
            
            
            
            NVD: CVE-2017-14459

SOURCES
db:CNVDid:CNVD-2018-10105
db:VULHUBid:VHN-105183
db:VULMONid:CVE-2017-14459
db:JVNDBid:JVNDB-2017-013280
db:CNNVDid:CNNVD-201709-609
db:NVDid:CVE-2017-14459

LAST UPDATE DATE
2024-11-23T23:02:10.971000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-10105date:2018-05-23T00:00:00
db:VULHUBid:VHN-105183date:2018-05-22T00:00:00
db:VULMONid:CVE-2017-14459date:2018-05-22T00:00:00
db:JVNDBid:JVNDB-2017-013280date:2018-06-18T00:00:00
db:CNNVDid:CNNVD-201709-609date:2022-04-20T00:00:00
db:NVDid:CVE-2017-14459date:2024-11-21T03:12:50.197

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-10105date:2018-05-23T00:00:00
db:VULHUBid:VHN-105183date:2018-04-11T00:00:00
db:VULMONid:CVE-2017-14459date:2018-04-11T00:00:00
db:JVNDBid:JVNDB-2017-013280date:2018-06-18T00:00:00
db:CNNVDid:CNNVD-201709-609date:2017-09-15T00:00:00
db:NVDid:CVE-2017-14459date:2018-04-11T16:29:00.213