CVE-2018-19659

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/net_WebPingGetValue can result in running OS commands as the root user. This is similar to CVE-2017-12120.

• CWE-78

• http://packetstormsecurity.com/files/150535/Moxa-NPort-W2x50A-2.1-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Nov/64Exploit, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/150535/Moxa-NPort-W2x50A-2.1-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Nov/64Exploit, Mailing List, Third Party Advisory

Published

Dec 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19650Local attackers can trigger a stack-based buffer overflow on…
• CVE-2018-19651admin/functions/remote.php in Interspire Email Marketer thro…
• CVE-2018-19653HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent…
• CVE-2018-19654An issue was discovered in Sales & Company Management System…7.5
• CVE-2018-19655A stack-based buffer overflow in the find_green() function o…
• CVE-2018-19658The Markdown editor in YXBJ before 8.3.2 on macOS has stored…5.4
• CVE-2018-19660An exploitable authenticated command-injection vulnerability…
• CVE-2018-19661An issue was discovered in libsndfile 1.0.28. There is a buf…
• CVE-2018-19662An issue was discovered in libsndfile 1.0.28. There is a buf…
• CVE-2018-19664libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the…
• CVE-2018-19665The Bluetooth subsystem in QEMU mishandles negative values f…5.7
• CVE-2018-19666The agent in OSSEC through 3.1.0 on Windows allows local use…