CVE-2019-5162

An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

• CWE-284

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0955Exploit, Technical Description, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0955Exploit, Technical Description, Third Party Advisory

Published

Feb 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5156An exploitable command injection vulnerability exists in the…7.2
• CVE-2019-5157An exploitable command injection vulnerability exists in the…7.2
• CVE-2019-5158An exploitable firmware downgrade vulnerability exists in th…7.8
• CVE-2019-5159An exploitable improper input validation vulnerability exist…7.8
• CVE-2019-5160An exploitable improper host validation vulnerability exists…9.1
• CVE-2019-5161An exploitable remote code execution vulnerability exists in…9.1
• CVE-2019-5163An exploitable denial-of-service vulnerability exists in the…7.5
• CVE-2019-5164An exploitable code execution vulnerability exists in the ss…7.8
• CVE-2019-5165An exploitable authentication bypass vulnerability exists in…7.2
• CVE-2019-5166An exploitable stack buffer overflow vulnerability exists in…7.8
• CVE-2019-5167An exploitable command injection vulnerability exists in the…7.8
• CVE-2019-5168An exploitable command injection vulnerability exists in the…7.8