VARIoT IoT vulnerabilities database

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. This vulnerability originates from the failure of network systems or products to properly filter resources or special elements in file paths. Attackers can use this vulnerability to access restricted directories. Outside location

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed. Xiaomi Mi WiFi R3G The device contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Xiaomi Mi WiFi R3G is a 3G router of China Xiaomi Technology Corporation. Xiaomi Mi WiFi R3G backup file upload processing has a security vulnerability that allows remote attackers to use the vulnerability to submit special requests and execute arbitrary OS commands

An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-010 Product: Wireless Keyboard Set LX390 Manufacturer: Fujitsu Affected Version(s): Model No. GK381 Tested Version(s): Model No. GK381 Vulnerability Type: Missing Encryption of Sensitive Data (CWE-311) Risk Level: High Solution Status: Open (product reached end-of-life (EOL) in May 2019) Manufacturer Notification: 2019-04-01 Solution Date: - Public Disclosure: 2019-10-23 CVE Reference: CVE-2019-18201 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Fujitsu Wireless Keyboard Set LX390 is a wireless desktop set consisting of a mouse and a keyboard. The manufacturer describes the product as follows (see [1, 2]): "The Wireless Keyboard Set LX390 is an excellent desktop solution for users with ambition. This durable keyboard set is equipped with secure 2.4 GHz technology and plug and play technology. The elegant mouse works on most surfaces due to its precise 1000 dpi sensor. However, the payload and checksum of data packets are transmitted in an encoded way using so-called data whitening or data scrambling of the used 2.4 GHz radio transceiver. Thus, without knowing this data whitening mechanism and its configuration, an attacker cannot actually gain access to the cleartext payload contents of transmitted radio packets during a sniffing attack. By analyzing the Fujitsu LX390 keyboard and its radio communication, SySS was able to identify the used communication protocol, the data whitening mechanism, and how to find the correct data whitening configuration by sniffing the radio communication of a specific keyboard. With this knowledge, an attacker can remotely analyze and decode sent keyboard events of a Fujitsu LX390 keyboard as cleartext, for instance keystrokes, and thus gain unauthorized access to sensitive data like passwords. Knowing how to analyze the data communication of a Fujitsu LX390 keyboard also enabled SySS to synthesize valid data packets which allowed for key stroke injection attacks, which are described in the SySS security advisory SYSS-2019-011 (see [3]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): SySS GmbH could successfully perform sniffing attacks against the 2.4 GHz radio communication of the Fujitsu LX390 keyboard using a software-defined radio and an in-house developed software tool utilizing GNU Radio [3]. For the protocol analysis,the software tool Universal Radio Hacker [4] was used. SySS GmbH could also perform successful sniffing attacks using another in-house developed software tool in combination with the USB radio dongle Crazyradio PA and the nrf-research-firmware by Bastille Networks Internet Security written by Marc Newlin (see [6] and [7]). The following output of the developed PoC software tool illustrates a successful keystroke sniffing attack. # python3 fujitsu_lx390_sniffer.py -l -p "3b:5b:53:bd:43" -c 28 _ __ _ _ ____ _ __ __ | |/ /___ _ _ ___| |_ _ __ ___ | | _____ / ___| _ __ (_)/ _|/ _| ___ _ __ | ' // _ \ | | / __| __| '__/ _ \| |/ / _ \ \___ \| '_ \| | |_| |_ / _ \ '__| | . \ __/ |_| \__ \ |_| | | (_) | < __/ ___) | | | | | _| _| __/ | |_|\_\___|\__, |___/\__|_| \___/|_|\_\___| |____/|_| |_|_|_| |_| \___|_| |___/ SySS Fujitsu LX390 Keystroke Sniffer - PoC Tool v0.1 by Matthias Deeg - SySS GmbH Based on different tools by Marc Newlin - --- 3B:5B:53:BD:43:DB 42:EF:F5:0A:2D 02:45:13:93:AB KEY_P 3B:5B:53:BD:43:DB 42:CF:F5:0C:CB 02:41:13:F3:CC KEY_P 3B:5B:53:BD:43:DB 42:EF:F5:0A:2D 02:45:13:93:AB KEY_P 3B:5B:53:BD:43:DB 42:CF:1D:70:ED 02:41:04:CD:A8 KEY_A 3B:5B:53:BD:43:DB 42:EF:1D:76:0B 02:45:04:AD:CF KEY_A 3B:5B:53:BD:43:DB 42:CF:1D:70:ED 02:41:04:CD:A8 KEY_A 3B:5B:53:BD:43:DB 42:EF:55:BF:C7 02:45:16:3E:FC KEY_S 3B:5B:53:BD:43:DB 42:CF:55:B9:21 02:41:16:5E:9B KEY_S 3B:5B:53:BD:43:DB 42:EF:55:BF:C7 02:45:16:3E:FC KEY_S 3B:5B:53:BD:43:DB 42:EF:65:89:94 02:45:1A:52:36 KEY_W (...) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: The Fujitsu Wireless Keyboard Set LX390 reached its end-of-life (EOL) in May 2019. SySS recommends replacing LX390 wireless keyboard sets used in environments with higher security demands, for instance with one of the newer successor models LX410 or LX960. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2019-04-01: Vulnerability reported to manufacturer 2019-04-02: Fujitsu confirms receipt of security advisory and asks questions regarding the reported security issue; answered open questions 2019-04-11: Received further questions from manufacturer 2019-04-18: Answered open questions and postponed disclosure date 2019-10-08: Reminded manufacturer of the upcoming release of the security advisory 2019-10-18: Discussed details of coordinated disclosure with manufacturer 2019-10-21: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Fujitsu Wireless Keyboard Set LX390 https://www.fujitsu.com/global/products/computing/peripheral/accessories/input-devices/keyboards/keyboard-lx390.html [2] Data sheet Fujitsu Wireless Keyboard Set LX390 https://produktinfo.conrad.com/datenblaetter/1300000-1399999/001375431-da-01-en-FUJITSU_DESKTOP_SET_WIREL_LX390_WEISS.pdf [3] SySS Security Advisory SYSS-2019-011 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-011.txt [4] GNU Radio https://www.gnuradio.org/ [5] Universal Radio Hacker (URH) https://github.com/jopohl/urh [6] Product website for Crazyradio PA https://www.bitcraze.io/crazyradio-pa/ [7] Bastille's nRF24 research firmware and tools https://github.com/BastilleResearch/nrf-research-firmware [8] Product website for Fujitsu Wireless Keyboard Set LX410 https://www.fujitsu.com/global/products/computing/peripheral/accessories/input-devices/keyboards/keyboard-lx410.html [9] Product website for Fujitsu Wireless Keyboard Set LX960 https://www.fujitsu.com/global/products/computing/peripheral/accessories/input-devices/keyboards/keyboard-lx960.html [10] SySS Security Advisory SYSS-2019-010 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-010.txt [11] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAl2wG84ACgkQ2aS/ajSt TasGfA/6A2+us49Z3ZAYp/ctq+bCORNooowoZFf0eYW5+k0pLOuVusTA+sGwnxgN VZcCpAzGKkkXiqOI+vVgzyncjzFY33GAiFEat+pFjsxRL9clO0rKKWTymTKA5uIR 1nn4cR98gfgB5ik5u6WZSQeH6hmP/kEmjRMjS0B7LjrFu+oWU3rnIqS4RhcSYRdd 9JSEdj2wD9R3IHwglZE7t8d/p4OBXmq+Ith0fzssJW2J+salsqwuD8YK58fMe1J5 i8WutJry1LCW+eYrC9MQYWSYVlj82manqoyP8GLJtRkt9Wk1Zp+kNr4bn7t8GP0J N/QTLzUOrOfL9tsbsPxOU6t5rCS40iZdD3d2UFDQPgJHreUA6ocJN3f4ajnzwq7h Xj/Q+t43zhfi6IqbqBciDBzFskO/AVyo7odP7RRt5g4p8fE40+PogNegaO+n1vBv K2gTPGk3pgogkxT+Dk8fpPalVltr7eSRz+0/3KLun9JUgQMJc1SB2pjNDlV6nAFC vg7QJ6aWufrNKia4/NorKXrD48ubBkvA6R+CVDed1ePbbQSDpFzjgVRHoc+5vXsE BCU/QlEK6LmM2OylFvsmlEaHA/UDmXb2ppCrxTbgAywcKlJ3JogbgKaKrKfLXTn0 lpFMUy3CyDUJmP2mT5uzsGqp+nj97TBWgdPcaccd7xEeWxU9xW4= =Noe8 -----END PGP SIGNATURE-----

There is an out of bound read vulnerability in some Huawei products. A remote, unauthenticated attacker may send a corrupt or crafted message to the affected products. Due to a buffer read overflow error when parsing the message, successful exploit may cause some service to be abnormal. plural Huawei The product contains an out-of-bounds vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state

Mitsubishi FX5U series PLC It is the latest generation of Mitsubishi small programmable controller. Mitsubishi FX5U series PLC A denial of service vulnerability exists. Attackers can cause devices to fail by sending specially crafted packets ( by Gx Works Can't start normally, but can only be recovered by hardware power failure ) .

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. An overflow vulnerability exists in the Siemens SIMATIC WinCC ReportRenderer.dll control. The attacker caused an overflow by constructing a very large integer

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. A stack overflow vulnerability exists in the Siemens SIMATIC WinCC CCScriptConv.dll control. An attacker can execute arbitrary code by constructing parameters

Siemens SIMATIC STEP 7 (TIA Portal) is a set of programming software for SIMATIC controllers from Siemens (Germany). The software provides PLC programming, design option packages and advanced driver technology. An integer overflow vulnerability exists in the sacommoncontrols.dll control of Siemens SIMATIC STEP 7. An attacker could exploit the vulnerability to cause an integer overflow

Siemens SIMATIC STEP 7 (TIA Portal) is a set of programming software for SIMATIC controllers from Siemens (Germany). The software provides PLC programming, design option packages and advanced driver technology. The S7HTREEX.OCX control of Siemens SIMATIC STEP 7 has an out-of-bounds access vulnerability. An attacker could exploit the vulnerability to cause out-of-bounds access

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. A stack overflow vulnerability exists in the Siemens SIMATIC WinCC CCDiagnosis.dll control. An attacker can execute arbitrary code by constructing parameters

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. There is a null pointer vulnerability in the Siemens SIMATIC WinCC CCRedCodiAlarm control. An attacker could exploit the vulnerability to cause a denial of service

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. A stack overflow vulnerability exists in the Siemens SIMATIC WinCC CcApEditAction.dll control. An attacker executes arbitrary code by constructing an input string, causing a stack overflow

Siemens SIMATIC STEP 7 (TIA Portal) is a set of programming software for SIMATIC controllers from Siemens (Germany). The software provides PLC programming, design option packages and advanced driver technology. An integer overflow vulnerability exists in the S7hcom_x.dll control of Siemens SIMATIC STEP 7. An attacker could exploit the vulnerability to cause an integer overflow

Siemens SIMATIC is an automation software with a single engineering environment. WinCC supports the discovery and configuration of LAN device information using the PN-DCP protocol at the Ethernet layer. An arbitrary file writing vulnerability exists in the Siemens SIMATIC WinCC PdlComponents.dll control. An attacker can call this function to write to any file on the computer, including generating a malicious program

Hunan Santang Information Technology Co., Ltd. takes the IT operation and maintenance integration platform and IT operation and maintenance service sharing platform as the core, and the business system supplemented by the university's smart laboratory and IT customization development to create an "Internet of Things" type IT integrated operation and maintenance platform , Help users to visualize unified operation and maintenance management of IT assets. An arbitrary password reset vulnerability exists in the front desk of the laboratory management system of Hunan Santang Information Technology Co., Ltd. An attacker can use the vulnerability to reset the administrator account password.

Hunan Santang Information Technology Co., Ltd. takes the IT operation and maintenance integration platform and IT operation and maintenance service sharing platform as the core, and the business system supplemented by the university's smart laboratory and IT customization development to create an "Internet of Things" type IT integrated operation and maintenance platform , Help users to visualize unified operation and maintenance management of IT assets. There is a SQL injection vulnerability in the front of the laboratory management system of Hunan Santang Information Technology Co., Ltd. An attacker can use the vulnerability to obtain database information.

On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi. RICOH MP 501 The printer contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The RICOH MP 501 is a printer from the Japanese company RICOH. The vulnerability stems from the lack of proper verification of client data by web applications. Attackers can use this vulnerability to execute client code

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. FortiMail admin Vulnerable to a lack of authentication.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Fortinet FortiMail is a suite of e-mail security gateway products from Fortinet. The product provides features such as email security and data protection. Fortinet FortiMail version 6.2.0, versions 6.0.0 to 6.0.6, and versions 5.4.10 and earlier have security vulnerabilities

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. FortiMail admin Contains an incorrect authentication vulnerability.Information may be obtained. Fortinet FortiMail is a suite of e-mail security gateway products from Fortinet. The product provides features such as email security and data protection. Fortinet FortiMail version 6.2.0, versions 6.0.0 to 6.0.6, and versions 5.4.10 and earlier have security vulnerabilities. Attackers can exploit this vulnerability to download system backup configuration files

An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only. Fortinet FortiOS Contains a vulnerability related to lack of entropy.Information may be obtained. Fortinet FortiOS is a set of security operating system dedicated to the FortiGate network security platform developed by Fortinet. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam. Fortinet FortiOS versions 6.2.1, 6.2.0, 6.0.8 and earlier have security signature vulnerabilities in the deterministic (pseudo-random) number generator (PRNG). An attacker could exploit this vulnerability to obtain sensitive information