PT-2019-9357 · Vtech · Vtech Storio Max
Publicado
2019-06-19
·
Atualizado
2020-08-24
·
CVE-2018-16618
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
VTech Storio Max version before 56.D3JM6
Description
The issue allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668, listening for requests on localhost. Requests submitted to this service are checked for a string of random characters followed by the name of an Android activity to start. By inserting metacharacters, this can be exploited to run arbitrary commands as root. The requests also match those of the HTTP protocol and can be triggered on any web page rendered on the device by requesting resources stored at an http://127.0.0.1:1668/ URI.
Recommendations
For VTech Storio Max version before 56.D3JM6, update to version 56.D3JM6 or later to resolve the issue. As a temporary workaround, consider restricting access to the storeintenttranslate.x service on port 1668 to minimize the risk of exploitation. Avoid using the
http://127.0.0.1:1668/ endpoint in web pages rendered on the device until the issue is resolved.Exploit
Correção
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Vtech Storio Max