CVE-2018-10698
📋 TL;DR
Moxa AWK-3121 devices version 1.14 have an unencrypted TELNET service enabled by default with default credentials. This allows attackers to intercept communications via man-in-the-middle attacks or directly access the device using known credentials. Organizations using these devices in their networks are affected.
💻 Affected Systems
- Moxa AWK-3121
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network infiltration, data exfiltration, and potential use as a pivot point for attacking other systems.
Likely Case
Unauthorized access to device configuration, credential harvesting, and potential command execution on the device.
If Mitigated
Limited to no impact if TELNET is disabled, credentials are changed, and proper network segmentation is implemented.
🎯 Exploit Status
Exploitation requires only TELNET access and knowledge of default credentials. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: Not found in provided references
Restart Required: No
Instructions:
Check Moxa's official security advisories for firmware updates. If available, download and apply the latest firmware following vendor instructions.
🔧 Temporary Workarounds
Disable TELNET service
allTurn off the unencrypted TELNET service and use SSH instead if available.
telnet disable
service telnet stop
Change default credentials
allImmediately change all default passwords on the device.
passwd admin
configure user password
🧯 If You Can't Patch
- Network segmentation: Isolate AWK-3121 devices in separate VLANs with strict access controls.
- Access control lists: Implement firewall rules to restrict TELNET access to authorized management networks only.
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to port 23 of the device using default credentials (admin/admin or similar).Check Version:
show version or similar device-specific command to display firmware versionVerify Fix Applied:
Verify TELNET service is not running on port 23 and that default credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed TELNET authentication attempts
- Successful TELNET logins from unexpected sources
Network Indicators:
- TELNET traffic to AWK-3121 devices on port 23
- Unusual outbound connections from AWK-3121 devices
SIEM Query:
source_ip="AWK-3121_IP" AND (port=23 OR protocol="TELNET")🔗 References
- http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html
- https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121
- https://seclists.org/bugtraq/2019/Jun/8
- http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html
- https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121
- https://seclists.org/bugtraq/2019/Jun/8
