CWE Code: 78
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary: an exploitable command injection vulnerability exists in the web server functionality of moxa edr-810 v4.1 build 17030317. a specially crafted http post can cause a privilege escalation resulting in root shell. an attacker can inject os commands into the remotenetmask0= parameter in the "/goform/net\_web\_get_value" uri to trigger this vulnerability.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-05-14
Last Modified Date: 2018-06-15