CWE Code: 78
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary: an exploitable command injection vulnerability exists in the web server functionality of moxa edr-810 v4.1 build 17030317. a specially crafted http post can cause a privilege escalation, resulting in a root shell. an attacker can inject os commands into the ip= parm in the "/goform/net_webpinggetvalue" uri to trigger this vulnerability.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-05-14
Last Modified Date: 2018-06-15