ICSA-19-337-02: Moxa AWK-3121
The device uses HTTP traffic by default allowing insecure communication to the web server, which could allow an attacker to compromise sensitive data such as credentials.CVE-2018-10690 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). An attacker can navigate to a URL and download the system log without authentication, which may allow access to sensitive information.CVE-2018-10691 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A cross-site scripting attack allows access to session cookies, which may allow an attacker to login into the device.CVE-2018-10692 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). An unauthorized user may execute network troubleshooting commands to cause a buffer overflow condition, which may allow the attacker to execute commands on the device.CVE-2018-10693 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Wi-Fi connection used to set up the device is not encrypted by default, which may allow an attacker to capture sensitive data.CVE-2018-10694 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). An unauthorized user may cause a buffer overflow using the device alert functionality, which may allow the attacker to execute commands on the device.CVE-2018-10695 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The web interface is not protected against CSRF attacks, which may allow an attacker to trick a user into executing commands or actions by clicking a malicious link.CVE-2018-10696 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthorized user may inject malicious commands into the system while using network troubleshooting functions, which may allow the attacker to execute unauthorized commands on the device.CVE-2018-10697 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The system enables an insecure service by default, which may allow an attacker to view sensitive information or modify information being transmitted through a man-in-the-middle attack.CVE-2018-10698 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthorized user can inject malicious commands while using system certificate functions, which may allow the attacker to execute unauthorized commands on the device.CVE-2018-10699 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An unauthorized user can execute an XSS attack, which may allow the injection of a malicious payload on the server.CVE-2018-10700 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). An unauthorized user may cause a buffer overflow on the system using system troubleshooting functions, which may allow the attacker to execute commands.CVE-2018-10701 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An unauthorized user may inject malicious commands on the system using system troubleshooting functions, which may allow the attacker to execute commands on the device.CVE-2018-10702 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An unauthorized user may cause a buffer overflow on the system using system troubleshooting functions, which may allow the attacker to execute commands on the device.CVE-2018-10703 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 8.8