PT-2022-11999 · Hiby · Hiby Music Hiby Os R3 Pro

Published 2022-03-28 · Updated 2022-04-04 · CVE-2021-44124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hiby Music Hiby OS R3 Pro versions 1.5 through 1.6

Description The issue allows an attacker to navigate through the device's file system over HTTP due to insufficient input data sanitization in the HTTP Server when displaying data from the SD Card. This is a result of a Directory Traversal vulnerability.

Recommendations For versions 1.5 and 1.6, consider restricting access to the HTTP Server until a patch is available. As a temporary workaround, avoid using the HTTP Server to display data from the SD Card until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-44124

Affected Products

Hiby Music Hiby Os R3 Pro

References · 5

• 🔥 https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626 · Exploit
• 🔥 https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal · Exploit
• https://osv.dev/vulnerability/CVE-2021-44124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44124 · Security Note
• https://t.me/cibsecurity/39651 · Telegram Post