CVE-2019-5162
Summary
| CVE | CVE-2019-5162 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-02-25 16:15:00 UTC |
| Updated | 2022-06-13 19:58:00 UTC |
| Description | An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Moxa | Awk-3131a | - | All | All | All |
| Hardware | Moxa | Awk-3131a | - | All | All | All |
| Operating System | Moxa | Awk-3131a Firmware | 1.13 | All | All | All |
| Operating System | Moxa | Awk-3131a Firmware | 1.13 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| TALOS-2019-0955 || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence | MISC | talosintelligence.com | Exploit, Technical Description, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 591341 Moxa AWK-3131A Series Multiple Vulnerabilities (MPSA-200203)