PT-2017-2688 · Ecoscentric · Ecos Embedded Web Servers+1

Published 2017-07-13 · Updated 2020-02-27 · CVE-2017-1000020

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eCos versions 1 and other versions ECos Embedded Web Servers (affected versions not specified)

Description The issue is related to a web authentication bypass in eCos Embedded Web Servers used by multiple routers and home devices. When sending SYN Flood or FIN Flood packets, the web server fails to validate and handle the packets, resulting in authentication bypass. This allows an attacker to take control of the device remotely or locally. The estimated number of potentially affected devices is not specified.

Recommendations For eCos version 1 and other affected versions, consider disabling the web server functionality until a patch is available to prevent exploitation. Restrict access to the embedded web server to minimize the risk of exploitation. Avoid using the embedded web server for authentication purposes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2017-01917

CVE-2017-1000020

Affected Products

Ecos

Ecos Embedded Web Servers

References · 5

• https://osv.dev/vulnerability/CVE-2017-1000020 · Vendor Advisory
• http://ecos.sourceware.org/ecos/problemreport.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01917 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000020 · Security Note
• https://t.me/cibsecurity/10125 · Telegram Post