As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.

Product support

Security Advisories

SUMMARY

AWK-3131A/4131A/1131A/1137C Series Wireless AP/Bridge/Client Vulnerabilities

  • Security Advisory ID: MPSA-211210
  • Version: V1.0
  • Release Date: Dec 30, 2021
  • Reference:
    • CVE-2021-37752, CVE-2021-37753, CVE-2021-37755, CVE-2021-37757, CVE-2021-37751, CVE-2021-37754, CVE-2021-37756, CVE-2021-37758

Multiple product vulnerabilities were identified in Moxa’s AWK-3131A/4131A/1131A/1137C Series Wireless AP/Bridge/Client. In response to this, Moxa has developed related solutions to address these vulnerabilities.

The identified vulnerability types and potential impacts are shown below:

Item Vulnerability Type Impact
1 Command Injection for Authentication (CWE-77), CVE-2021-37752 An attacker located remotely can execute arbitrary commands on the device via a web interface.
2 Authentication Bypass and Unencrypted Credentials
(CWE-303, CWE-256), CVE-2021-37753, CVE-2021-37755
An attacker located remotely can bypass authentication mechanisms.
3 Improper Restriction That Causes Buffer Overflow
(CWE-119), CVE-2021-37757
An attacker located remotely can crash the service of the devices.
4 Reveals Sensitive Information to an Unauthorized Actor (CWE-204), CVE-2021-37751 An attacker located remotely can obtain sensitive information.
5 Improper Restriction of Excessive Authentication Attempts
(CWE-307), CVE-2021-37754
An attacker located remotely can use brute force to obtain credentials.
6 Cross-site scripting (XSS)
(CWE-79), CVE-2021-37756
An attacker located remotely can insert HTML and JavaScript into the system via a web interface.
7 Improper Verification of Firmware
(CWE-347), CVE-2021-37758
An attacker can create malicious firmware for the device.

 

AFFECTED PRODUCTS AND SOLUTIONS

Affected Products:

The affected products and firmware versions are shown below.

Product Series Affected Versions
AWK-3131A Series Firmware Version 1.16 or lower.
AWK-4131A Series Firmware Version 1.16 or lower.
AWK-1131A Series Firmware Version 1.22 or lower.
AWK-1137C Series Firmware Version 1.6 or lower.

 

Solutions:

Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below.

Product Series Solutions
AWK-3131A Series
AWK-4131A Series
AWK-1131A Series
AWK-1137C Series
For item 1: Users can disable the HTTP console and enable HTTPs by device configuration.

For items 2 to 5: Users can disable the Moxa Service console by configuring the device.

For item 6: Please upgrade to the latest firmware.
For item 7: We recommend users download firmware from Moxa.com or another trusted source. We also provide SHA-512 checksum for firmware integrity check.

 

Acknowledgment:

We would like to express our appreciation to Jake Baines from Dragos for reporting the vulnerability, working with us to help enhance the security of our products, and helping us provide a better service to our customers

 

Revision History:

VERSION DESCRIPTION RELEASE DATE
1.0 First Release Dec 30, 2021

Relevant Products

AWK-1131A Series · AWK-1137C Series · AWK-3131A Series · AWK-4131A Series ·

  •   Print this page
  • You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability
Added To Bag
You have some items waiting in your bag; click here to finish your quote!
Feedback