CVE-2018-10700
Summary
| CVE | CVE-2018-10700 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-06-07 20:29:00 UTC |
| Updated | 2019-06-10 23:29:00 UTC |
| Description | An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Moxa | Awk-3121 | - | All | All | All |
| Hardware | Moxa | Awk-3121 | - | All | All | All |
| Operating System | Moxa | Awk-3121 Firmware | 1.19 | All | All | All |
| Operating System | Moxa | Awk-3121 Firmware | 1.19 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Moxa AWK-3121 1.14 Information Disclosure / Command Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Moxa_AWK_1121/Moxa_AWK_1121 at master · samuelhuntley/Moxa_AWK_1121 · GitHub | MISC | github.com | Exploit, Third Party Advisory |
| Bugtraq: Newly releases IoT security issues | BUGTRAQ | seclists.org | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.