CVE-2019-14918 in Smart Energy Router SG600R2
Summary
by MITRE
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/20/2024
The vulnerability CVE-2019-14918 represents a cross-site scripting flaw discovered in the Billion Smart Energy Router SG600R2 firmware version 3.02.rc6. This security weakness resides within the DHCP lease-status table functionality, specifically affecting the web interface component located at etc_ro/web/internet/dhcpcliinfo.asp. The vulnerability stems from insufficient input validation and output sanitization mechanisms within the router's web administration interface, creating a pathway for malicious actors to execute unauthorized code on client systems that interact with the compromised device.
The technical exploitation of this vulnerability occurs through crafted DHCP request packets that are sent to the affected router. When the router processes these malformed requests and displays the resulting information in the DHCP lease-status table, the malicious HTML/JavaScript code becomes embedded in the web page output. This occurs because the router fails to properly escape or filter user-supplied data before rendering it within the web interface, directly violating established security principles for web application development and input validation. The flaw manifests as a classic reflected cross-site scripting vulnerability where the malicious payload is reflected back to the user's browser without proper sanitization.
From an operational perspective, this vulnerability presents significant risks to network security and user privacy. An attacker positioned within the same network segment can leverage this weakness to execute arbitrary JavaScript code in the context of a victim's browser session, potentially leading to session hijacking, credential theft, or redirection to malicious websites. The attack vector requires only network access to send specially crafted DHCP packets, making it particularly dangerous in environments where network access is not strictly controlled. This vulnerability affects the router's web-based management interface, which typically requires authentication but can still be exploited to compromise user sessions once access is obtained.
The impact of this vulnerability extends beyond simple code execution, as it can be leveraged as a stepping stone for more sophisticated attacks within a network environment. According to the CWE (Common Weakness Enumeration) framework, this represents a CWE-79: Improper Neutralization of Input During Web Page Generation, which is a fundamental web security weakness. The vulnerability aligns with ATT&CK technique T1059.007 for JavaScript execution, and potentially T1566 for initial access through network-based attacks. Organizations should implement immediate mitigations including firmware updates from the vendor, network segmentation to limit DHCP access, and monitoring for unusual DHCP traffic patterns. Additionally, network administrators should consider implementing web application firewalls and input validation controls to prevent similar vulnerabilities in other network devices and web applications.