RCE in Moxa Awk-3131a
CVE-2016-8721
An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device. An attacker can exploit this vulnerability remotely.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.033 (87.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Moxa Awk-3131a
- Moxa Awk-3131a_firmware — versions 1.1
- Moxa Awk-3131a Wap — versions 1.1 Build 15122211
Weakness classification (CWE)
Public proof-of-concept exploits
References
- talos-cna@cisco.com (Technical Description, Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2016-8721?
- CVE-2016-8721 is a critical-severity vulnerability in Moxa Awk-3131a, classified under OS Command Injection. CVSS score: 9.1/10. Published 2017-04-20.
- How severe is CVE-2016-8721?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2016-8721 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.