Taser Axon Dock up to 3.1.160322.2252 /lua/set-passwd.lua privileges management

Summaryinfo

A vulnerability was found in Taser Axon Dock up to 3.1.160322.2252. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file /lua/set-passwd.lua. This manipulation causes privileges management. Furthermore, there is an exploit available. This vulnerability is considered historic because of its background and reception. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Taser Axon Dock up to 3.1.160322.2252. Affected by this vulnerability is an unknown code block of the file /lua/set-passwd.lua. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The bug was discovered 06/18/2016. The weakness was shared 08/15/2016 by Reginald Dodd as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The vendor cooperated in the coordination of the public release. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/23/2019). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

The Axon Dock is the camera docking station component of Taser's body-worn camera system. It charges body-worn cameras and automatically uploads videos to Taser's Evidence.com after body-worn cameras are stored onto it. System owners can remotely manage the dock through a web browser by navigating to http://<IP>. Remote unauthenticated users can obtain administrator access and reconfigure the Axon Dock.

A public exploit has been developed by Reginald Dodd in URL and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 51 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.2.160726.1852 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability. The mailinglist post contains the following remark:

If your dock is not updated, try to update the dock manually in the firmware section of the remote console. Contact Taser if you have any complications.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Taser

Name

• Axon Dock

Version

• 3.1.160322.2252

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion