CVE-2017-8416 Details

CVE-2017-8416

Published: 2019-07-02
Last Modified: 2019-07-10
CVE Author: NIST National Vulnerability Database
CVE Assigner: cve@mitre.org
Summary

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.

Analysis
Common Vulnerability Score System v2.0
Severity High
Base Score 8.3/10
Exploit Score 6.5/10
Access Vector Adjacent_network
Access Complexity Low
Authentication None
Impact Score 10/10
Confidentiality Impact Complete
Availability Impact Complete
Integrity Impact Complete
Vector String AV:A/AC:L/Au:N/C:C/I:C/A:C
Common Vulnerability Score System v3.1
Severity High
Base Score 8.8/10
Exploit Score 2.8/10
Access Vector Adjacent_network
Access Complexity Low
Privileges Required None
Impact Score 5.9/10
Confidentiality Impact High
Availability Impact High
Integrity Impact High
Scope Unchanged
User Interaction None
Vector String CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Products Reported
CPE Vulnerable Start Excluding
cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:* Yes - -
cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:* No - -
cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:* Yes - -
cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:* No - -
References

http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
https://seclists.org/bugtraq/2019/Jun/8

CVE ID
CVE-2017-8416
Published
2019-07-02
Modified
2019-07-10
CVSSv2.0
High
CVSSv3.1
High
PCI Compliance
Fail
US-CERT Alert
No
CWE
CWE-119

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities.