A vulnerability was found in TecnoVISION DLX Spot Player4 up to 1.5.9 and classified as critical. Affected by this issue is an unknown part of the file resource.php of the component File Upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

The bug was discovered 05/14/2017. The weakness was published 09/21/2017 as File 144258/Dlx (Packetstorm). The advisory is available at packetstormsecurity.com. This vulnerability is handled as CVE-2017-12929 since 08/17/2017. The attack may be launched remotely. A simple authentication is necessary for exploitation. Technical details as well as a public exploit are known. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 130 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:resource.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.5.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (42753). Similar entries are available at VDB-106969 and VDB-106971.

Productinfo

Vendor

• TecnoVISION

Name

• DLX Spot Player4

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion