CVE-2017-12125 - An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317

Back Back to CVE browser

HIGH

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317

Published May 14, 2018

8.8

HIGH

CVSS 3.1

EPSS 3.96%

Description

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the "/goform/net_WebCSRGen" uri to trigger this vulnerability.

Affected products

Vendor Talos Product Moxa Default
unknown
Affected
- Moxa EDR-810 V4.1 build 17030317

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Talos	Moxa	unknown	Affected Moxa EDR-810 V4.1 build 17030317

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3709
Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0477
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3709		Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0477		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published May 14, 2018

Updated Sep 16, 2024

Reserved Jul 31, 2017

Link CVE-2017-12125

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-12125

Red Hat

No data

ENISA EUVD

Assigner talos

Published May 14, 2018

Updated Sep 16, 2024

Link EUVD-2017-3709

GitHub

No data