CVE-2017-14432: Command Injection
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0tmp= parameter in the "/goform/net\Web\getvalue" uri to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14432?
The severity of CVE-2017-14432 is critical due to its potential for privilege escalation to root.
How do I fix CVE-2017-14432?
To fix CVE-2017-14432, update the firmware of the Moxa EDR-810 to a version that addresses this vulnerability.
What devices are affected by CVE-2017-14432?
The affected device is the Moxa EDR-810 running firmware version 4.1.
Can CVE-2017-14432 lead to a remote attack?
Yes, CVE-2017-14432 can be exploited remotely through specially crafted HTTP POST requests.
Is CVE-2017-14432 a command injection vulnerability?
Yes, CVE-2017-14432 is a command injection vulnerability allowing an attacker to execute OS commands.