RCE in Moxa Awk-3131a
CVE-2016-8721
An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device. An attacker can exploit this vulnerability remotely.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.033 (88.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
- Moxa Awk-3131a
- Moxa Awk-3131a Firmware — versions 1.1
- Moxa Awk-3131a Wap — versions 1.1 Build 15122211
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.talosintelligence.com/reports/TALOS-2016-0235/ (Technical Description, Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-8721?
- CVE-2016-8721 is a critical-severity vulnerability in Moxa Awk-3131a, classified under OS Command Injection. CVSS score: 9.1/10. Published 2017-04-20.
- How severe is CVE-2016-8721?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2016-8721 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.