PT-2019-7955 · Starry · Starry Station

Publicado 2019-06-10 · Atualizado 2019-06-11 · CVE-2017-13718

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Starry Station (aka Starry Router) (affected versions not specified)

Description The HTTP API supported by the device allows brute forcing the PIN setup by the user, enabling an attacker to change Wi-Fi settings and PIN, as well as port forward and expose internal devices' ports to the Internet. The device uses custom Python code called "rodman" that allows the mobile application to interact with the device using a secret, which is a uuid4 based session identifier, or a security code, which is the PIN number set by the user. An attacker on the Internet can interact with the router's HTTP interface when a user navigates to the attacker's website and brute force the credentials. The device's server sets the Access-Control-Allow-Origin header to "*", allowing an attacker to easily interact with the JSON payload returned by the device and steal sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2017-13718

Produtos afetados

Starry Station

Referências · 5

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf · Exploit
• https://t.me/cibsecurity/4822 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-13718 · Nota de Segurança
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html · Nota