CVE-2019-5148: moxa awk-3131a_firmware Out-of-bounds Read

Vulnerability summary

CVE-2019-5148 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in moxa awk-3131a_firmware. EPSS estimates a 2.48% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-02-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.