PT-2019-8617 · Securifi+1 · Securifi Almond+3

Mandar Satam · Published 2019-06-18 · Updated 2019-06-21 · CVE-2017-8330

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096

Description An issue was discovered in the UPnP functionality of the devices, where the NewInMessage SOAP parameter passed with a huge payload results in crashing the process. The miniupnpd binary contains the vulnerable function that receives the values sent by the SOAP request. The function WscDevPutMessage at address 0x0041DBB8 receives the values sent in the SOAP request, and the NewInMessage parameter received at address 0x0041DC30 causes the miniupnpd process to crash when a second request is sent to the same process.

Recommendations For Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096, consider disabling the miniupnpd binary or restricting access to the UPnP functionality as a temporary workaround until a patch is available. Avoid using the NewInMessage SOAP parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-8330

Affected Products

Almond 2015

Almond+

Securifi Almond

Miniupnpd

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Securifi_Almond_plus_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8330 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8330 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• https://t.me/cibsecurity/5000 · Telegram Post
• http://packetstormsecurity.com/files/153227/Securifi-Almond-2015-Buffer-Overflow-Command-Injection-XSS-CSRF.html · Note