PT-2018-15034
CVE-2018-19659
·
تاريخ النشر
2018-12-06
·
تاريخ التحديث
2019-01-30
الوصف من
CVSS 2.0
9.0
عاليةالمقاييسAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311
Description
An exploitable authenticated command-injection issue exists in the web server functionality. A specially crafted HTTP POST request to "/goform/net WebPingGetValue" can result in running OS commands as the root user.
Recommendations
For Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311, update the firmware to version 2.2 Build 18082311 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/goform/net WebPingGetValue" endpoint to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾