Rewterz Threat Advisory – ICS: Moxa AWK-3121 Multiple Vulnerabilities

Severity

High

Analysis Summary

CVE-2018-10690

The device uses HTTP traffic by default allowing insecure communication to the web server, which could allow an attacker to compromise sensitive data such as credentials.

CVE-2018-10691

An attacker can navigate to a URL and download the system log without authentication, which may allow access to sensitive information.

CVE-2018-10692

A cross-site scripting attack allows access to session cookies, which may allow an attacker to login into the device.

CVE-2018-10693

An unauthorized user may execute network troubleshooting commands to cause a buffer overflow condition, which may allow the attacker to execute commands on the device.

CVE-2018-10694

The Wi-Fi connection used to set up the device is not encrypted by default, which may allow an attacker to capture sensitive data.

CVE-2018-10695

An unauthorized user may cause a buffer overflow using the device alert functionality, which may allow the attacker to execute commands on the device.

CVE-2018-10696

The web interface is not protected against CSRF attacks, which may allow an attacker to trick a user into executing commands or actions by clicking a malicious link.

CVE-2018-10697

An unauthorized user may inject malicious commands into the system while using network troubleshooting functions, which may allow the attacker to execute unauthorized commands on the device.

CVE-2018-10698

The system enables an insecure service by default, which may allow an attacker to view sensitive information or modify information being transmitted through a man-in-the-middle attack.

CVE-2018-10699

An unauthorized user can inject malicious commands while using system certificate functions, which may allow the attacker to execute unauthorized commands on the device.

CVE-2018-10700

An unauthorized user can execute an XSS attack, which may allow the injection of a malicious payload on the server.

CVE-2018-10701

An unauthorized user may cause a buffer overflow on the system using system troubleshooting functions, which may allow the attacker to execute commands.

CVE-2018-10702

An unauthorized user may inject malicious commands on the system using system troubleshooting functions, which may allow the attacker to execute commands on the device.

CVE-2018-10703

An unauthorized user may cause a buffer overflow on the system using system troubleshooting functions, which may allow the attacker to execute commands on the device.

Impact

• Exposure of sensitive information,
• Cause availability issues
• Execute remote code.

Affected Vendors

Moxa

Affected Products

AWK-3121: All Versions 1.14 and prior

Remediation

This device has reached end of life and has been replaced by model AWK-1131A.

Moxa recommends users apply the latest security patch:

https://www.moxa.com/en/support/support/technical-support