Full Report
A critical vulnerability in Moxa AWK-3131A industrial access point could allow an unauthorized attacker to execute arbitrary code by injecting system commands
Analysis Summary
# Vulnerability: Command Injection in Moxa AWK-3131A Industrial Access Point
## CVE Details
- **CVE ID:** CVE-2018-7013
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
## Affected Systems
- **Products:** Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client.
- **Versions:** All firmware versions prior to v1.12.
- **Configurations:** Systems with the web management interface accessible over the network.
## Vulnerability Description
The vulnerability is a classic OS command injection flaw located within the web interface of the device. The application fails to properly neutralize or sanitize user-supplied input before using it in a system call. An unauthenticated attacker can craft a malicious HTTP request containing shell metacharacters to execute arbitrary commands with the privileges of the web service (typically root on embedded industrial devices).
## Exploitation
- **Status:** Publicly disclosed; PoC is functionally trivial for command injection.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to device data and credentials)
- **Integrity:** Total (Ability to modify configuration, firmware, or system files)
- **Availability:** Total (Ability to brick the device, shut it down, or disrupt industrial wireless communications)
## Remediation
### Patches
- **Moxa AWK-3131A Firmware v1.12:** This version addresses the vulnerability by implementing proper input validation.
- Users should download the latest firmware from the Moxa support website.
### Workarounds
- **Network Segmentation:** Place industrial access points on a dedicated management VLAN isolated from the public internet and general corporate traffic.
- **Access Control Lists (ACLs):** Restrict access to the web management interface (HTTP/HTTPS) to specific trusted administrator IP addresses.
- **Disable Unused Services:** Disable the web server if management is performed exclusively via console/serial, though this may not be practical for all deployments.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected shell characters (e.g., `;`, `|`, `&`, `` ` ``) in HTTP server logs.
- Unexplained reboots or configuration changes.
- New, unauthorized listening ports on the device.
- **Detection Methods:** Vulnerability scanners (e.g., Nessus, OpenVAS) typically have plugins to detect outdated firmware versions on Moxa devices.
## References
- **Vendor Advisory:** hxxps[://]www[.]moxa[.]com/en/support/product-support/security-advisories
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/publications/reports/2018/04/06/critical-vulnerability-closed-in-moxa-awk-3131a-industrial-access-point/
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2018-7013