CVE-2018-10701

Vulnerability

The vulnerability exists in the script execution functionality of Moxa AWK-3121 devices running firmware version 1.14. The POST parameter iw_filename is susceptible to a buffer overflow. By sending a packet with a string of 162 characters in this parameter, an attacker can trigger the overflow. The affected code path is available to any user who can reach the device's web interface, as no authentication is required for this functionality.

Exploitation

An attacker with network access to the device can exploit this vulnerability by crafting a POST request to the vulnerable endpoint with the iw_filename parameter set to a 162-character string. The exact steps are detailed in the referenced proof-of-concept code [1]. No prior authentication or user interaction is needed.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the device with the privileges of the web server (likely root). This leads to full compromise of the device, including potential data exfiltration, device misconfiguration, or use as a pivot point in the network.

Mitigation

As of the publication date (2019-06-07), no official patch was available from Moxa. Users should restrict network access to the device's web interface to trusted administrators only. If a newer firmware version is later released, it should be applied. The device may be end-of-life, so replacement may be necessary.