QwikSec

Security Database

CVE

CWE

Training

CVE-2018-19660

Published: Dec 6, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20181130 Multiple OS Command Injection in Moxa NPort W2x50A products

mailing-list

x_refsource_FULLDISC

http://packetstormsecurity.com/files/150535/Moxa-NPort-W2x50A-2.1-OS-Command-Injection.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.