PT-2019-8617 · Securifi+1 · Securifi Almond+3

Mandar Satam · Publicado 2019-06-18 · Atualizado 2019-06-21 · CVE-2017-8330

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096

Description An issue was discovered in the UPnP functionality of the devices, where the NewInMessage SOAP parameter passed with a huge payload results in crashing the process. The miniupnpd binary contains the vulnerable function that receives the values sent by the SOAP request. The function WscDevPutMessage at address 0x0041DBB8 receives the values sent in the SOAP request, and the NewInMessage parameter received at address 0x0041DC30 causes the miniupnpd process to crash when a second request is sent to the same process.

Recommendations For Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096, consider disabling the miniupnpd binary or restricting access to the UPnP functionality as a temporary workaround until a patch is available. Avoid using the NewInMessage SOAP parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-8330

Produtos afetados

Almond 2015

Almond+

Securifi Almond

Miniupnpd

Referências · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Securifi_Almond_plus_sec_issues.pdf · Exploit
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8330 · Nota de Segurança
• https://t.me/cibsecurity/5000 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-8330 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153227/Securifi-Almond-2015-Buffer-Overflow-Command-Injection-XSS-CSRF.html · Nota