House iStar Ultra up to 6.5.2.20569 IP-ACM Ethernet Door Messages access control

Summaryinfo

A vulnerability was found in House iStar Ultra up to 6.5.2.20569. It has been declared as critical. This impacts an unknown function of the component IP-ACM Ethernet Door Module. Executing a manipulation as part of Messages can lead to access control. This vulnerability appears as CVE-2017-17704. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in House iStar Ultra up to 6.5.2.20569 and classified as critical. This vulnerability affects some unknown processing of the component IP-ACM Ethernet Door Module. The manipulation as part of a Messages leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.

The bug was discovered 12/18/2017. The weakness was presented 12/31/2017 (Website). The advisory is shared for download at systemoverlord.com. This vulnerability was named CVE-2017-17704 since 12/15/2017. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 12 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• House

Name

• iStar Ultra

Version

• 6.5.2.20569

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion