CVEvulnerability
CVE-2018-10698
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-311
Description
An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user.
Affected configurations
• moxa awk-3121 firmware 1.14
Related
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 Third Party Advisory
- https://seclists.org/bugtraq/2019/Jun/8 Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 Third Party Advisory
- https://seclists.org/bugtraq/2019/Jun/8 Mailing List, Third Party Advisory