PT-2021-19388 · Arlo · Arlo Q Plus

Pedrib1337 + 3 · Published 2021-06-14 · Updated 2021-07-07 · CVE-2021-31505

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Arlo Q Plus version 1.9.0.3 278

Description This issue allows attackers with physical access to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the SSH service, where the device can be booted into a special operation mode and hard-coded credentials are accepted for SSH authentication. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of root.

Recommendations For Arlo Q Plus version 1.9.0.3 278, as a temporary workaround, consider disabling the SSH service until a patch is available. Restrict physical access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-31505

ZDI-21-683

Affected Products

Arlo Q Plus

References · 6

• https://kb.arlo.com/000062592/Security-Advisory-for-Arlo-Q-Plus-SSH-Use-of-Hard-coded-Credentials-Allowing-Privilege-Escalation · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31505 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-683 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31505 · Vendor Advisory
• https://t.me/cibsecurity/25785 · Telegram Post
• https://t.me/cvenotify/17207 · Telegram Post