CVE-2019-5162 Missing authorization in Moxa

Critical 9.9 Published 25 Feb 2020 Updated 4 Aug 2024

An attacker with low-privilege access can overwrite another user's password to gain remote shell access on Moxa AWK-3131A devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5162?

CVE-2019-5162 is a critical missing authorization vulnerability in Moxa, published on 25 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

Weakness: CWE-284

Which versions are affected by CVE-2019-5162?

It affects 1 product.

Products include Moxa Awk-3131a Firmware.

How do I fix CVE-2019-5162?

No fix has been published for CVE-2019-5162 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-5162 being exploited?

There is no known exploitation of CVE-2019-5162 in the wild and no public exploit code.

Sources

Also known as GHSA-536j-cvcw-6cqq.