#VU21474 Input validation error in Moxa EDR-810 - CVE-2019-10969
Published: October 2, 2019 / Updated: October 23, 2019
Vulnerability identifier: #VU21474
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2019-10969
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Moxa EDR-810
Moxa EDR-810
Software vendor:
Moxa
Moxa
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input on the web console via the "Admin" or "ConfigAdmin" account. A remote authenticated administrator can abuse the ping feature to execute unauthorized commands on the router and execute arbitrary code on the target system as root.
Remediation
Install updates from vendor's website.