PT-2021-11402 · Rostelecom · Rostelecom Cs-C2Shw

Published 2021-01-25 · Updated 2021-02-02 · CVE-2020-27540

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Rostelecom CS-C2SHW version 5.0.082.1

Description: A Bash injection vulnerability and bypass of signature verification exist in the firmware update process. The camera reads firmware update configuration from an SD card file named 'version.json'. The 'fw-sign' parameter from this configuration is directly inserted into a bash command, allowing for potential injection. Firmware updates are run automatically if a special file is present on the inserted SD card.

Recommendations: For version 5.0.082.1, as a temporary workaround, consider restricting access to the SD card or avoiding the use of the automatic firmware update feature until a patch is available. Additionally, restrict the execution of bash commands with external input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-27540

Affected Products

Rostelecom Cs-C2Shw

References · 3

• 🔥 https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27540 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27540 · Vendor Advisory