VARIoT IoT vulnerabilities database

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. plural D-Link The product contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. DWR-116, DIR-140, DIR-640, etc. are all D-Link router products. There are shell command injection vulnerabilities in multiple series of http-servers of D-Link routers. D-Link DWR-116, etc. The following products and versions are affected: D-Link DWR-116 1.06 and earlier; DWR-512 2.02 and earlier; DWR-712 2.02 and earlier; DWR-912 2.02 and earlier; DWR-921 2.02 and earlier; DWR-111 1.01 and earlier versions. An issue exists on D-Link DWR-116 up to and including 1.06, DWR-512 up to and including 2.02, DWR-712 up to and including 2.02, DWR-912 up to and including 2.02, DWR-921 up to and including 2.02, and DWR-111 up to and including 1.01 devices. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa MULTIPLE VULNERABILITIES IN D-LINK ROUTERS Blazej Adamczyk (br0x) blazej.adamczyk@gmail.com http://sploit.tech/ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 12.10.2018 1 Directory Traversal in httpd server in several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aa CVE: CVE-2018-10822 CVSS v3: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Directory traversal vulnerability in the web interface on D-Link routers: aC/ DWR-116 through 1.06, aC/ DIR-140L through 1.02, aC/ DIR-640L through 1.02, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190. PoC: aaaaa a $ curl http://routerip/uir//etc/passwd aaaaa The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824 This vulnerability was reported previously by Patryk Bogdan in CVE-2017-6190 but he reported it is fixed in certain release but unfortunately it is still present in even newer releases. The vulnerability is also present in other D-Link routers and can be exploited not only (as the original author stated) by double dot but also absolutely using double slash. 2 Password stored in plaintext in several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa CVE: CVE-2018-10824 An issue was discovered on D-Link routers: aC/ DWR-116 through 1.06, aC/ DIR-140L through 1.02, aC/ DIR-640L through 1.02, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware. NOTE: I have changed the filename in description to XXX because the vendor leaves some EOL routers unpatched and the attack is too simple. The administrative password is stored in plaintext in the /tmp/XXX/0 file. An attacker having a directory traversal (or LFI) can easily get full router access. PoC using the directory traversal vulnerability disclosed at the same time - CVE-2018-10822 aaaaa a $ curl http://routerip/uir//tmp/XXX/0 aaaaa This command returns a binary config file which contains admin username and password as well as many other router configuration settings. By using the directory traversal vulnerability it is possible to read the file without authentication. 3 Shell command injection in httpd server of a several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaa CVE: CVE-2018-10823 CVSS v3: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) An issue was discovered on D-Link routers: aC/ DWR-116 through 1.06, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware. PoC: 1. 2. Request the following URL after login: aaaaa a $ curl http://routerip/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20 %2Fetc%2Fpasswd aaaaa 3. See the passwd file contents in the response. 4 Exploiting all together aaaaaaaaaaaaaaaaaaaaaaaaa CVSS v3: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Taking all the three together it is easy to gain full router control including arbitrary code execution. Description with video: [http://sploit.tech/2018/10/12/D-Link.html] 5 Timeline aaaaaaaaaa aC/ 09.05.2018 - vendor notified aC/ 06.06.2018 - asked vendor about the status because of long vendor response aC/ 22.06.2018 - received a reply that a patch will be released for DWR-116 and DWR-111, for the other devices which are EOL an announcement will be released aC/ 09.09.2018 - still no reply from vendor about the patches or announcement, I have warned the vendor that if I will not get a reply in a month I will publish the disclosure aC/ 12.10.2018 - disclosing the vulnerabilities

A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. The product provides security policy, intrusion detection and other functions in the wireless LAN. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvi97023

A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is due to incorrect parsing of a specific TACACS attribute received in the TACACS response from the remote TACACS server. An attacker could exploit this vulnerability by authenticating via TACACS to the GUI on the affected device. A successful exploit could allow an attacker to create local user accounts with administrative privileges on an affected WLC and execute other commands that are not allowed from the CLI and should be prohibited. The Cisco Wireless LAN Controller (WLC) is a wireless LAN controller product from Cisco. The product provides security policy, intrusion detection and other functions in the wireless LAN. This issue is tracked by Cisco Bug ID CSCvh65876. There is a security vulnerability in the TACACS authentication mechanism in Cisco WLC Software

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information. This issue is being tracked by Cisco bug ID CSCvj33439. The platform can realize the full lifecycle management of virtualized services through the central coordinator and controller

LAquis SCADA Versions 4.1.0.3870 and prior has several stack-based buffer overflow vulnerabilities, which may allow remote code execution. LAquis SCADA Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within aq.exe. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this functionality to execute code in the context of the current process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition

LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution. LAquis SCADA Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of LQS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. At attacker can leverage this vulnerability to execute code under the context of the current process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LAquis SCADA Smart Security Manager is prone to following multiple security vulnerabilities: 1. Remote-code execution vulnerability 2. Multiple unspecified interger overflow vulnerability 3. Directory traversal vulnerability 4. Failed attacks may cause a denial-of-service condition. LAquis SCADA mart Security Manager Versions 4.1.0.3870 and prior versions are vulnerable

LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code execution. LAquis SCADA Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of LQS files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. At attacker can leverage this vulnerability to execute code under the context of the current process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LAquis SCADA Smart Security Manager is prone to following multiple security vulnerabilities: 1. Remote-code execution vulnerability 2. Multiple unspecified interger overflow vulnerability 3. Directory traversal vulnerability 4. Failed attacks may cause a denial-of-service condition. LAquis SCADA mart Security Manager Versions 4.1.0.3870 and prior versions are vulnerable

LAquis SCADA Versions 4.1.0.3870 and prior, when processing project files the application fails to sanitize user input prior to performing write operations on a stack object, which may allow an attacker to execute code under the current process. LAquis SCADA Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of LQS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the application. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition

LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution. LAquis SCADA Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LAquis SCADA Smart Security Manager is prone to following multiple security vulnerabilities: 1. Remote-code execution vulnerability 2. Multiple unspecified interger overflow vulnerability 3. Directory traversal vulnerability 4. Failed attacks may cause a denial-of-service condition. LAquis SCADA mart Security Manager Versions 4.1.0.3870 and prior versions are vulnerable

LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution. LAquis SCADA Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of LQS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. At attacker can leverage this vulnerability to execute code under the context of the current process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LAquis SCADA Smart Security Manager is prone to following multiple security vulnerabilities: 1. Remote-code execution vulnerability 2. Multiple unspecified interger overflow vulnerability 3. Directory traversal vulnerability 4. Failed attacks may cause a denial-of-service condition. LAquis SCADA mart Security Manager Versions 4.1.0.3870 and prior versions are vulnerable

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application of an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition. Cisco NX-OS The software contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco NX-OS is a network operating system for Cisco Nexus Series Ethernet Switches and MDS Series Fibre Channel Storage Area Network Switches. Cisco NX-OS Software is prone to a denial-of-service vulnerability An attacker can exploit this issue to restart the affected system, denying service to legitimate users. This issue is being tracked by Cisco bug ID CSCvj70029. Nexus 9500 R-Series Line Cards and Fabric Modules is a 9500 R-Series line card module. NX-OS Software is a data center-level operating system software used by a set of switches running on it. The following products are affected: Cisco Nexus 3000 Series Switches (NX-OS Software Release 7.0(3)I7(3)); Nexus 3600 Platform Switches (NX-OS Software Release 7.0(3)F3(4)); Nexus 9000 Series Switches in standalone NX-OS mode (NX-OS Software 7.0(3)I7(3) version); Nexus 9500 R-Series Line Cards and Fabric Modules (NX-OS Software 7.0(3)F3(4) version)

goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter. Orange AirBox Contains an information disclosure vulnerability.Information may be obtained. OrangeAirBox is a portable wireless router product from Orange, Luxembourg. There is a security vulnerability in goform/getWlanClientInfo in the OrangeAirBoxY858_FL_01.16_04 release

goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials. Orange AirBox Contains vulnerabilities related to security features.Information may be tampered with. Orange AirBox is a portable wireless router product of Orange Company in Luxembourg

goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter. Orange AirBox Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Orange AirBox is a portable wireless router product of Orange Company in Luxembourg. There is a security vulnerability in goform/getProfileList in Orange AirBox Y858_FL_01.16_04 version

FUJI XEROX ApeosPort-V 5070 and FUJI XEROX ApeosPort-V C3375 are printer products launched by Fuji Xerox. Command execution vulnerability exists in FUJI XEROX multi-series printer products. Attackers can use the vulnerability to execute commands, upload files, delete printer system files, and cause printer DOS.

Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges. Teltonika RUT9XX Router firmware contains vulnerabilities related to authorization, authority, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TeltonikaRUT9XXrouters (also known as LuCI) is a router product from Teltonika, Lithuania. There is an arbitrary command execution vulnerability in TeltonikaRUT9XX with firmware version lower than 00.04.223

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution. ** Unsettled ** This case has not been confirmed as a vulnerability. The vendor has disputed this vulnerability. For details, see NVD of Current Description Please Confirm. https://nvd.nist.gov/vuln/detail/CVE-2018-18320Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Asuswrt-Merlin is a firmware from ASUS that runs on its router. Merlin.PHP is one of the web-based management panel components

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote code execution. ** Unsettled ** This case has not been confirmed as a vulnerability. The vendor has disputed this vulnerability. For details, see NVD of Current Description Please Confirm. https://nvd.nist.gov/vuln/detail/CVE-2018-18319Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Asuswrt-Merlin is a firmware from ASUS that runs on its router. Merlin.PHP is one of the web-based management panel components

The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone. Huawei Mate 9 and Mate 9 Pro Smartphones have vulnerabilities related to authorization, authority, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. HuaweiMate9 and Mate9Pro are both Huawei's smartphone products. The vulnerability is due to insufficient input verification in the hardware security module of some Huawei phones. The Huawei Mate 9 and Mate 9 Pro are smartphones from the Chinese company Huawei

The /dev/block/mmcblk0rpmb driver kernel module on Qiku 360 Phone N6 Pro 1801-A01 devices allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted 0xc0d8b300 ioctl call. Qiku360PhoneN6Pro1801-A01 is a smart phone from China Qiku Internet Technology Company