PT-2019-7868 · Shekar · Shekar Endoscope

Ethanhunnt + 1 · Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-10724

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shekar Endoscope (affected versions not specified)

Description A memory corruption issue was discovered in the Shekar Endoscope device, allowing an attacker connected to the device's Wi-Fi SSID to execute remote code on the device. This device is used in various industrial systems, car garages, and medical clinics to access areas difficult for humans to reach. A breach of this system can allow an attacker to access the video feed and pictures viewed by the user and potentially gain a foothold in air-gapped networks, especially in nation-critical infrastructure and industries. The firmware contains a binary uvc stream, which is a UDP daemon responsible for handling UDP requests. The client application sends a UDP request to change the Wi-Fi name, which is handled by the control Dev thread function. This function calls setwifipassword, which uses a memcpy function with the length of the payload obtained by the strlen function, allowing an attacker to overflow the function and control the $PC value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-10724

Affected Products

Shekar Endoscope

References · 5

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10724 · Security Note
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html · Note
• https://t.me/cibsecurity/4965 · Telegram Post