CVE-2017-14459

published 2018-04-11

CVE-2017-14459: An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n…

Priority P2 74 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
moxa	awk-3131a_firmware	—	—
moxa	awk-3131a_firmware	—	—
moxa	awk-3131a_firmware	—	—
moxa	awk-3131a_firmware	—	—
talos	moxa	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /usr/sbin/iw_event_user↗

command telnetd -p<port> -l/var/<script>↗

command `<command>`↗

command printf "%s">>/var/<filename>↗

snort↗

45220

• → Inject commands via the Telnet/SSH login username field — look for backtick-wrapped payloads (e.g., `<cmd>`) or shell metacharacters in the username field of Telnet/SSH login attempts targeting Moxa AWK-3131A devices. ↗
• → Spaces in injected commands are replaced with ${IFS} to bypass input filtering — detect ${IFS} in Telnet/SSH username fields as a strong indicator of exploitation. ↗
• → Attacker redirects stdout to stderr (1>&2) in injected commands to receive output on the console — detect '1>&2' in username fields. ↗
• → Post-exploitation backdoor is established by writing shell scripts to /var and launching telnetd on a random high port (2048–4096) — monitor for unexpected telnetd processes and new listening ports in that range on Moxa devices. ↗
• → The exploit writes a shell launcher script (#!/bin/sh\nexec sh) and a telnetd launcher to /var on the device — monitor for new executable files created in /var on Moxa AWK-3131A devices. ↗

• · Affected firmware versions are 1.4 through 1.7 (current at time of disclosure); versions 1.3 and earlier are also vulnerable but less easily exploitable due to differences in log event generation. ↗
• · The web application login may also be vulnerable since it relies on the same Busybox loginutils code path — iw_event_user binary contains 'fail' messages for 'WEB', 'TELNET', and 'SSH'. ↗
• · The vulnerability is unauthenticated — no credentials are required to trigger command injection; exploitation occurs at the login prompt itself. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78