Vulnerability in Moxa Awk-3121
CVE-2018-10694
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well.
EPSS: 0.008 (53.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Moxa Awk-3121
- Moxa Awk-3121_firmware — versions 1.14
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-10694?
- CVE-2018-10694 is a high-severity vulnerability in Moxa Awk-3121, classified under Missing Encryption of Sensitive Data. CVSS score: 8.1/10. Published 2019-06-07.
- How severe is CVE-2018-10694?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2018-10694 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.