CVE-2019-5140: OS Command Injection

Published Feb 25, 2020

Updated

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

Affected Software

2 affected components

MOXA AWK-3131A firmware=1.13

MOXA AWK-3131A

Event History

Feb 25, 2020

CVE Published

via MITRE·03:25 PM

Data Sourced

via MITRE·03:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-5140?

CVE-2019-5140 is a command injection vulnerability in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13.

How severe is CVE-2019-5140?

CVE-2019-5140 has a severity rating of 8.8, which is considered high.

How does CVE-2019-5140 work?

CVE-2019-5140 allows an attacker to execute arbitrary commands on the device by exploiting a command injection vulnerability in the iwwebs functionality of the Moxa AWK-3131A firmware.

Is there a fix for CVE-2019-5140?

A fix for CVE-2019-5140 is not available at the moment. It is recommended to apply security patches or updates from the vendor when they become available.

Are there any known references for CVE-2019-5140?

Yes, you can find more information about CVE-2019-5140 at the following reference: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0929