PT-2021-11401 · Rostelecom · Rostelecom Cs-C2Shw

Published 2021-01-25 · Updated 2021-02-02 · CVE-2020-27539

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Rostelecom CS-C2SHW version 5.0.082.1

Description: The issue is related to a heap overflow that occurs with full parsing of HTTP responses. This is due to a self-written HTTP parser and builder in the AgentUpdater service, which has a heap buffer overflow (OOB write). By default, the camera only parses responses from HTTPS URLs specified in the config file, making the vulnerable code unreachable without an additional bug to exploit it.

Recommendations: For Rostelecom CS-C2SHW version 5.0.082.1, as a temporary workaround, consider restricting access to the AgentUpdater service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-27539

Affected Products

Rostelecom Cs-C2Shw

References · 3

• 🔥 https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707 · Exploit
• https://osv.dev/vulnerability/CVE-2020-27539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27539 · Security Note