CVE-2018-19660

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2…

published December 6, 2018

CVSS

—

EPSS

29%

Percentile

98.1

In the wild

Unconfirmed

What it is

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.28804 · 98.1th percentile
Published: 2018-12-06T23:00Z

EPSS history

Timeline

06 DEC 23:00Z
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2…
cvelistv5