PT-2019-8619 · Securifi · Securifi Almond+2

Mandar Satam · Published 2019-06-18 · Updated 2019-06-21 · CVE-2017-8332

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096

Description An issue was discovered where the device does not implement any cross-site scripting protection mechanism. This allows an attacker to trick a user who is logged in to the web management interface into executing a stored cross-site scripting payload on the user's browser, enabling the execution of any action on the device provided by the web management interface. The device provides a feature to block key words passing in the web traffic to prevent kids from watching content that might be deemed unsafe using the web management interface.

Recommendations For Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096, consider disabling the web management interface until a patch is available to prevent exploitation. Restrict access to the web management interface to minimize the risk of cross-site scripting attacks. Avoid using the web management interface for sensitive actions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8332

Affected Products

Almond 2015

Almond+

Securifi Almond

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Securifi_Almond_plus_sec_issues.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-8332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8332 · Security Note
• https://t.me/cibsecurity/4998 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153227/Securifi-Almond-2015-Buffer-Overflow-Command-Injection-XSS-CSRF.html · Note