Details of VAR-201906-0774

ID

VAR-201906-0774

CVE

CVE-2017-8333

TITLE

Securifi Almond Command Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2019-18746 // CNNVD: CNNVD-201906-712

DESCRIPTION

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in passing commands to a "popen" API in the function and thus result in command injection on the device. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "dest" is extracted at address 0x00420FC4. The POST parameter "dest is concatenated in a route add command and this is passed to a "popen" function at address 0x00421220. This allows an attacker to provide the payload of his/her choice and finally take control of the device. Securifi Almond , Almond+ , Almond 2015 The device firmware contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SecurifiAlmond is a wireless router with a touch screen. The..

Trust: 2.34

sources: NVD: CVE-2017-8333 // JVNDB: JVNDB-2017-014537 // CNVD: CNVD-2019-18746 // VULHUB: VHN-116536 // VULMON: CVE-2017-8333

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-18746

AFFECTED PRODUCTS

vendor:	securifi	model:	almond 2015	scope:	eq	version:	al-r096	Trust: 1.8
vendor:	securifi	model:	almond	scope:	eq	version:	al-r096	Trust: 1.8
vendor:	securifi	model:	almond\+	scope:	eq	version:	al-r096	Trust: 1.0
vendor:	securifi	model:	almond+	scope:	eq	version:	al-r096	Trust: 0.8
vendor:	securifi	model:	almond+ al-r096	scope:	-	version:	-	Trust: 0.6
vendor:	securifi	model:	almond-2015 al-r096	scope:	-	version:	-	Trust: 0.6
vendor:	securifi	model:	almond al-r096	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2019-18746 // JVNDB: JVNDB-2017-014537 // NVD: CVE-2017-8333

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-8333
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-8333
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-18746
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201906-712
value:	HIGH
Trust: 0.6
VULHUB:	VHN-116536
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-8333
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-8333
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-18746
severity:	HIGH
baseScore:	7.6
vectorString:	AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-116536
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-8333
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2019-18746 // VULHUB: VHN-116536 // VULMON: CVE-2017-8333 // JVNDB: JVNDB-2017-014537 // CNNVD: CNNVD-201906-712 // NVD: CVE-2017-8333

PROBLEMTYPE DATA

problemtype:

CWE-77

Trust: 1.9

sources: VULHUB: VHN-116536 // JVNDB: JVNDB-2017-014537 // NVD: CVE-2017-8333

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201906-712

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-201906-712

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014537

PATCH

title:	almond	url:	https://www.securifi.com/ja/almond	Trust: 0.8
title:	almondplus	url:	https://www.securifi.com/ja/almondplus	Trust: 0.8
title:	almond-2015	url:	https://www.securifi.com/ja/almond-2015	Trust: 0.8
title:	SecurifiAlmond command to inject vulnerability patches	url:	https://www.cnvd.org.cn/patchInfo/show/164221	Trust: 0.6
title:	Securifi Almond Fixes for command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=93897	Trust: 0.6
title:	IoT_vulnerabilities	url:	https://github.com/ethanhunnt/IoT_vulnerabilities	Trust: 0.1

sources: CNVD: CNVD-2019-18746 // VULMON: CVE-2017-8333 // JVNDB: JVNDB-2017-014537 // CNNVD: CNNVD-201906-712

EXTERNAL IDS

db:	NVD	id:	CVE-2017-8333	Trust: 3.3
db:	PACKETSTORM	id:	153227	Trust: 2.5
db:	JVNDB	id:	JVNDB-2017-014537	Trust: 0.8
db:	CNVD	id:	CNVD-2019-18746	Trust: 0.6
db:	CNNVD	id:	CNNVD-201906-712	Trust: 0.6
db:	VULHUB	id:	VHN-116536	Trust: 0.1
db:	VULMON	id:	CVE-2017-8333	Trust: 0.1

sources: CNVD: CNVD-2019-18746 // VULHUB: VHN-116536 // VULMON: CVE-2017-8333 // JVNDB: JVNDB-2017-014537 // PACKETSTORM: 153227 // CNNVD: CNNVD-201906-712 // NVD: CVE-2017-8333

REFERENCES

url:	https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/securifi_almond_plus_sec_issues.pdf	Trust: 3.2
url:	https://seclists.org/bugtraq/2019/jun/8	Trust: 2.4
url:	http://packetstormsecurity.com/files/153227/securifi-almond-2015-buffer-overflow-command-injection-xss-csrf.html	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8333	Trust: 1.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8333	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/77.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/ethanhunnt/iot_vulnerabilities	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8330	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8335	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8329	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8337	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8328	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8331	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8336	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8334	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8332	Trust: 0.1

CREDITS

Mandar Satam

Trust: 0.1

sources: PACKETSTORM: 153227

SOURCES

db:	CNVD	id:	CNVD-2019-18746
db:	VULHUB	id:	VHN-116536
db:	VULMON	id:	CVE-2017-8333
db:	JVNDB	id:	JVNDB-2017-014537
db:	PACKETSTORM	id:	153227
db:	CNNVD	id:	CNNVD-201906-712
db:	NVD	id:	CVE-2017-8333

LAST UPDATE DATE

2024-11-23T21:52:10.592000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-18746	date:	2019-06-21T00:00:00
db:	VULHUB	id:	VHN-116536	date:	2019-06-21T00:00:00
db:	VULMON	id:	CVE-2017-8333	date:	2019-06-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-014537	date:	2019-06-25T00:00:00
db:	CNNVD	id:	CNNVD-201906-712	date:	2019-06-24T00:00:00
db:	NVD	id:	CVE-2017-8333	date:	2024-11-21T03:33:46.940

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-18746	date:	2019-06-21T00:00:00
db:	VULHUB	id:	VHN-116536	date:	2019-06-18T00:00:00
db:	VULMON	id:	CVE-2017-8333	date:	2019-06-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-014537	date:	2019-06-25T00:00:00
db:	PACKETSTORM	id:	153227	date:	2019-06-07T15:06:02
db:	CNNVD	id:	CNNVD-201906-712	date:	2019-06-18T00:00:00
db:	NVD	id:	CVE-2017-8333	date:	2019-06-18T20:15:11.860