CVE-2017-14432

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.8HIGH

EPSS

2.6%

top 14.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Talos Moxa Moxa Edr-810 Firmware

Timeline

PublishedMay 14

Latest updateMay 13

Description

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0_tmp= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5talos/moxaMoxa EDR-810 V4.1 build 17030317

▶NVDmoxa/edr-810_firmware4.1

🔴Vulnerability Details

GHSA

GHSA-r983-jx22-f3fr: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4↗2022-05-13

▶

CVEList

CVE-2017-14432: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4↗2018-05-14

▶