Stack-based buffer overflow in AWK-3131A Series - CVE-2019-5153

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the "iw_webs" configuration parsing functionality. A remote authenticated attacker can send specially crafted commands, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2019-5153

Sources

• https://www.moxa.com/en/support/support/security-advisory/awk-3131a-series-industrial-ap-bridge-client-vulnerabilities
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0944