CVE-2019-5138

CVE-2019-5138 is a critical command injection vulnerability affecting Moxa AWK-3131A firmware version 1.13. An authenticated, low-privilege attacker can exploit a flaw in the encrypted diagnostic script functionality to execute arbitrary busybox commands, gaining remote control over the device. With a CVSS score of 9.9, this vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.