CVE-2018-10702

Vulnerability

The vulnerability is present in Moxa AWK-3121 devices running firmware version 1.14. A script execution feature intended for troubleshooting accepts the POST parameter iw_filename without sanitizing shell metacharacters, enabling command injection [1]. An authenticated administrator can manipulate this parameter to inject arbitrary operating system commands.

Exploitation

An attacker must have administrative access to the device's web interface. By sending a crafted POST request to the script execution endpoint with malicious shell metacharacters (e.g., ;, |, &&, ` `) embedded in the iw_filename` parameter, the injected commands are executed in the context of the system shell [1]. No additional user interaction is required.

Impact

Successful exploitation gives the attacker full remote code execution with root-level privileges on the Moxa AWK-3121 [1]. This allows complete compromise of the device: data exfiltration, installation of persistent backdoors, denial of service, or pivoting into the internal network.

Mitigation

No official firmware patch is mentioned in the provided reference [1]. As a workaround, restrict administrative access to trusted networks only, monitor the device logs for suspicious POST requests, and contact Moxa support for the latest security updates. The device should not be exposed to untrusted networks.