Intex N150 Configuration File unrestricted upload

Summaryinfo

A vulnerability identified as critical has been detected in Intex N150. Affected by this issue is some unknown functionality of the component Configuration File Handler. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2018-12528. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Intex N150 (affected version not known). This issue affects some unknown functionality of the component Configuration File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup, which can lead to corrupting the router firmware settings or even the uploading of malicious files. In order to exploit the vulnerability, an attacker can upload any malicious file and force reboot the router with it.

The bug was discovered 06/25/2018. The weakness was presented 07/02/2018 (Website). It is possible to read the advisory at securitywarrior9.blogspot.com. The identification of this vulnerability is CVE-2018-12528 since 06/18/2018. The attack may be initiated remotely. A simple authentication is required for exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44933). See VDB-120144 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Intex

Name

• N150

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion