Dongguan Diqee Diqee360 mode_switch.sh REQUEST_SET_WIFIPASSWD UDP Packet command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Dongguan Diqee Diqee360. This issue affects the function REQUEST_SET_WIFIPASSWD of the file /mnt/skyeye/mode_switch.sh. The manipulation as part of UDP Packet leads to command injection. This vulnerability is listed as CVE-2018-10987. The attack may be initiated remotely. There is no available exploit. This vulnerability is considered historic because of its background and reception.

Detailsinfo

A vulnerability was found in Dongguan Diqee Diqee360 (affected version unknown) and classified as critical. This issue affects the function REQUEST_SET_WIFIPASSWD of the file /mnt/skyeye/mode_switch.sh. The manipulation as part of a UDP Packet leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute commands on the vacuum cleaner as root. The bug is in the function REQUEST_SET_WIFIPASSWD (UDP command 153). A crafted UDP packet runs "/mnt/skyeye/mode_switch.sh %s" with an attacker controlling the %s variable. In some cases, authentication can be achieved with the default password of 888888 for the admin account.

The bug was discovered 06/20/2018. The weakness was presented 07/05/2018 (Website). It is possible to read the advisory at gist.github.com. The identification of this vulnerability is CVE-2018-10987 since 05/11/2018. The attack may be initiated remotely. The successful exploitation needs a simple authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/25/2020). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact.

The vulnerability was handled as a non-public zero-day exploit for at least 15 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-120444 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Dongguan Diqee

Name

• Diqee360

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion