CVE-2018-10696: moxa awk-3121_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2018-10696 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in moxa awk-3121_firmware. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 07-06-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.