Vulnerability in Moxa Awk-3121
CVE-2018-10694
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Moxa Awk-3121
- Moxa Awk-3121 Firmware — versions 1.14
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 (Third Party Advisory)
- seclists.org/bugtraq/2019/Jun/8 (mailing-list, Mailing List, Third Party Advisory)
- packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-… (Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-10694?
- CVE-2018-10694 is a high-severity vulnerability in Moxa Awk-3121, classified under Missing Encryption of Sensitive Data. CVSS score: 8.1/10. Published 2019-06-07.
- How severe is CVE-2018-10694?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2018-10694 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.