Sign-up

ID

VAR-201906-0254


CVE

CVE-2019-12506


TITLE

Logitech R700 Laser Presentation Remote R-R0010 Injection Vulnerability

Trust: 1.4

sources: CNVD: CNVD-2019-17495 // JVNDB: JVNDB-2019-005412

DESCRIPTION

Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. The LogitechR700LaserPresentationRemoteR-R0010 is a wireless demonstration remote control from Logitech, Switzerland. An injection vulnerability exists in the LogitechR700LaserPresentationRemoteR-R0010. The vulnerability stems from the user's input of constructing commands, data structures, or records. The network system or product lacks proper verification of user input data, unfiltered or improperly filtered out special elements, resulting in system or product resolution or The explanation is wrong. Wrong way of interpreting. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-015 Product: R700 Laser Presentation Remote Manufacturer: Logitech Affected Version(s): Model R-R0010 (PID WD904XM and PID WD802XM) Tested Version(s): Model R-R0010 (PID WD904XM and PID WD802XM) Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345) Keystroke Injection Vulnerability Risk Level: High Solution Status: Open Manufacturer Notification: 2019-04-12 Solution Date: - Public Disclosure: 2019-06-04 CVE Reference: CVE-2019-12506 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Logitech R700 Laser Presentation Remote is a wireless presenter using 2.4 GHz radio communication. By knowing the used data protocol, it is possible to inject packets in the data communication that are actually interpreted as keystrokes by the receiver on the target system. The following output of the developed proof-of-concept software tool illustrates a successful attack: # python2 logitech_presenter.py -a 7F:20:9E:C2:07 _____ ______ ___ _ _ _____ _ _ | __ \| ____|__ \| || | | __ \| | | | _ __ | |__) | |__ ) | || |_ | |__) | | __ _ _ _ ___ ___| |_ | '_ \| _ /| __| / /|__ _| | ___/| |/ _` | | | / __|/ _ \ __| | | | | | \ \| | / /_ | | | | | | (_| | |_| \__ \ __/ |_ |_| |_|_| \_\_| |____| |_| |_| |_|\__,_|\__, |___/\___|\__| __/ | |___/ Logitech Wireless Presenter Attack Tool v1.0 by Matthias Deeg - SySS GmbH (c) 2016 [*] Configure nRF24 radio [*] Actively searching for address 07:C2:9E:20:7F [*] Ping success on channel 8 [*] Ping success on channel 8 [*] Press <CTRL+C> to start keystroke injection ^C [*] Start keystroke injection ... [*] Done. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for this reported security vulnerability. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2019-04-12: Vulnerability reported to manufacturer 2019-06-04: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Logitech R700 https://www.logitech.com/en-roeu/product/professional-presenter-r700 [2] Product website for Crazyradio PA https://www.bitcraze.io/crazyradio-pa/ [3] Bastille's nRF24 research firmware and tools https://github.com/BastilleResearch/nrf-research-firmware [4] SySS Security Advisory SYSS-2016-074 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-074.txt [5] SySS Security Advisory SYSS-2019-015 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-015.txt [6] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAlz03CQACgkQ2aS/ajSt TauaVw/8CVXlyjP8Y1ngNcAzZzq+THJb5wRsjpe7bMdD3mEi3AQTxt9y+REQO95k xP+D2LvgCopG1k7opQ6iH+4nmgOmy2cYx9XhitBHTr/QZ6xKgCm/eTtNGMrTT2pF SS+/n/5dbPTwQk2VXi0py+QMxp+21u/vt/ftmQYPy2lMqcVftJ/G/ANzxUQEFy7D Nk/tNg6ev68JmarCKu0c0vDMghW8mnt1tQVe1yxjHs7zDYJVkUCwT/iHPbQ1Wbfq uJ5TAvZ/czMoSeGBl0H1vrPnU855MOjIwPJcrQJj9eMFdPilTir9svEw4+ngYxv8 55yMagHYPUUs/OiluPfSoXagw+f6bQZQi7YBhCMo3DVUFZbDij9r+kpijOMD8oEB b/76A8B+rfyjpzOm1A6eR3qFfTP65XXVZyd8+Rb7K/zyPoXoSS4WbMnpyGQ+BiWP 9VsrOshEeO3EqetVbgQURbzvs9FZjPRPBurF1y5ujrYksIs+LdQzoqlMR6r+EHTd Atzr10S6W7usTwtvl97luEteOrmjv2lgPpLz0R7bLhSyOJo+mCl75CunKDaWIyPm zTW+v5wWNcrEiTQyP/zmahkZO3YXKOqXlaLE9rs2Q2V9uuimenCR7MIoKHNLtKiv +lHVKdRMw2Cqmet/sTpRWSYGPnxm/DbxVyy8YUCZl/iDTyEQHAk= =8Kcd -----END PGP SIGNATURE-----

Trust: 2.34

sources: NVD: CVE-2019-12506 // JVNDB: JVNDB-2019-005412 // CNVD: CNVD-2019-17495 // VULHUB: VHN-144259 // PACKETSTORM: 153186

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-17495

AFFECTED PRODUCTS

vendor:logitechmodel:r700 laser presentation remotescope:eqversion:wd802xm

Trust: 1.0

vendor:logitechmodel:r700 laser presentation remotescope:eqversion:wd904xm

Trust: 1.0

vendor:logitechmodel:r700 laser presentation remotescope: - version: -

Trust: 0.8

vendor:logitechmodel:r700 laser presentation remote r-r0010scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2019-17495 // JVNDB: JVNDB-2019-005412 // NVD: CVE-2019-12506

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-12506
value: HIGH

Trust: 1.0

NVD: CVE-2019-12506
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-17495
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201906-337
value: HIGH

Trust: 0.6

VULHUB: VHN-144259
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-12506
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-17495
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-144259
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-12506
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-17495 // VULHUB: VHN-144259 // JVNDB: JVNDB-2019-005412 // CNNVD: CNNVD-201906-337 // NVD: CVE-2019-12506

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.1

problemtype:CWE-319

Trust: 1.1

problemtype:CWE-74

Trust: 0.9

sources: VULHUB: VHN-144259 // JVNDB: JVNDB-2019-005412 // NVD: CVE-2019-12506

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201906-337

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201906-337

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-005412

PATCH
title:R700 Laser Presentation Remoteurl:https://www.logicool.co.jp/ja-jp/product/professional-presenter-r700
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-005412

EXTERNAL IDS
db:NVDid:CVE-2019-12506
Trust: 3.2
db:PACKETSTORMid:153186
Trust: 2.6
db:JVNDBid:JVNDB-2019-005412
Trust: 0.8
db:CNNVDid:CNNVD-201906-337
Trust: 0.7
db:CNVDid:CNVD-2019-17495
Trust: 0.6
db:VULHUBid:VHN-144259
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-17495 // 
            
            
            
            VULHUB: VHN-144259 // 
            
            
            
            JVNDB: JVNDB-2019-005412 // 
            
            
            
            PACKETSTORM: 153186 // 
            
            
            
            CNNVD: CNNVD-201906-337 // 
            
            
            
            NVD: CVE-2019-12506

REFERENCES
url:http://packetstormsecurity.com/files/153186/logitech-r700-laser-presentation-remote-keystroke-injection.html
Trust: 3.1
url:https://seclists.org/bugtraq/2019/jun/4
Trust: 2.3
url:https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2019-015.txt
Trust: 1.8
url:http://seclists.org/fulldisclosure/2019/jun/15
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-12506
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12506
Trust: 0.8
url:http://creativecommons.org/licenses/by/3.0/deed.en
Trust: 0.1
url:https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2016-074.txt
Trust: 0.1
url:https://www.syss.de/en/responsible-disclosure-policy/
Trust: 0.1
url:https://www.syss.de/fileadmin/dokumente/materialien/pgpkeys/matthias_deeg.asc
Trust: 0.1
url:https://www.logitech.com/en-roeu/product/professional-presenter-r700
Trust: 0.1
url:https://www.bitcraze.io/crazyradio-pa/
Trust: 0.1
url:https://github.com/bastilleresearch/nrf-research-firmware
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-17495 // 
            
            
            
            VULHUB: VHN-144259 // 
            
            
            
            JVNDB: JVNDB-2019-005412 // 
            
            
            
            PACKETSTORM: 153186 // 
            
            
            
            CNNVD: CNNVD-201906-337 // 
            
            
            
            NVD: CVE-2019-12506

CREDITS
Matthias Deeg
Trust: 0.1
sources:
            
            
            PACKETSTORM: 153186

SOURCES
db:CNVDid:CNVD-2019-17495
db:VULHUBid:VHN-144259
db:JVNDBid:JVNDB-2019-005412
db:PACKETSTORMid:153186
db:CNNVDid:CNNVD-201906-337
db:NVDid:CVE-2019-12506

LAST UPDATE DATE
2024-11-23T22:06:10.997000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-17495date:2019-06-15T00:00:00
db:VULHUBid:VHN-144259date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2019-005412date:2019-06-19T00:00:00
db:CNNVDid:CNNVD-201906-337date:2020-10-28T00:00:00
db:NVDid:CVE-2019-12506date:2024-11-21T04:22:59.737

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-17495date:2019-06-15T00:00:00
db:VULHUBid:VHN-144259date:2019-06-07T00:00:00
db:JVNDBid:JVNDB-2019-005412date:2019-06-19T00:00:00
db:PACKETSTORMid:153186date:2019-06-04T21:00:26
db:CNNVDid:CNNVD-201906-337date:2019-06-07T00:00:00
db:NVDid:CVE-2019-12506date:2019-06-07T21:29:02.277