CVE-2018-10700

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the device name change functionality of Moxa AWK-3121 devices running firmware version 1.19 [1]. The web application does not properly sanitize the iw_board_deviceName POST parameter, enabling an administrator-level user to inject arbitrary script code [1].

Exploitation

An attacker must first obtain administrative credentials to access the device management interface [1]. Once authenticated, the attacker can send a crafted POST request containing a malicious XSS payload in the iw_board_deviceName parameter [1]. The payload is then stored and executed when any user views the device's configuration page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected device [1]. This can lead to session hijacking, defacement, or theft of sensitive configuration data.

Mitigation

The vendor, Moxa, has not released a patched firmware version for the AWK-3121 to address this issue. The affected model is listed as end-of-life (EOL) and no longer receives firmware updates [1]. Administrators should restrict management interface access to trusted IP addresses and limit administrative privileges to reduce exposure.