PT-2022-18138 · Digi · Digi Passport Firmware

Breakfix + 3 · Published 2022-04-06 · Updated 2022-04-12 · CVE-2022-26952

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Digi Passport Firmware versions 1.5.1,1 and earlier

Description The issue is related to a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page. An attacker can supply a string in the page parameter for the "reboot.asp" endpoint, allowing him to force an overflow when the string is concatenated to the HTML body.

Recommendations For Digi Passport Firmware versions 1.5.1,1 and earlier, consider disabling the vulnerable function for building the Location header string until a patch is available. Restrict access to the "reboot.asp" endpoint to minimize the risk of exploitation. Avoid using the page parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-26952

Affected Products

Digi Passport Firmware

References · 7

• 🔥 https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md · Exploit
• https://hub.digi.com/support/products/infrastructure-management/digi-passport · Vendor Advisory
• https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26952 · Security Note
• https://t.me/cvenotify/28498 · Telegram Post
• https://t.me/cvenotify/28497 · Telegram Post