CVE-2017-14459: moxa awk-3131a_firmware OS Command Injection
Vulnerability summary
CVE-2017-14459 is a critical (CVSS 10.0) OS Command Injection vulnerability in moxa awk-3131a_firmware. EPSS estimates a 12.64% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 11-04-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
12.64%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 12.64% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMoxa AWK-3131A 1.4 < 1.7 - 'Username' OS Command Injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Moxa1 product
- awk-3131a_firmware1.4 | 1.5 | 1.6 | 1.7
Talos1 product
- moxaMoxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client versions 1.4 - 1.9. In addition, versions prior to 1.4 appear similarly vulnerable to injection, but not as easily exploitable (described below). Other models in the AWK product line may likewise be vulnerable but have not been tested.
2 vendors · 2 products