CVE-2018-10697: moxa awk-3121_firmware OS Command Injection
Vulnerability summary
CVE-2018-10697 is a high (CVSS 9.3) OS Command Injection vulnerability in moxa awk-3121_firmware. EPSS estimates a 3.71% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 07-06-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.71%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.71% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundMoxa Awk 1121
Maturity: poc
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Moxa1 product
1 vendor · 1 product
References
3 links- github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121X Refsource MISCExploitThird Party Advisory