CVE-2018-12257

An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.

CVSS v3 4.4 MEDIUM
CVSS v2.0 2.1 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:apollotechnologiesinc:momentum_axel_720p_firmware:5.1.8:*:*:*:*:*:*:*

cpe:2.3:h:apollotechnologiesinc:momentum_axel_720p:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-12 18:29

Updated : 2024-02-28 16:25

NVD link : CVE-2018-12257

Mitre link : CVE-2018-12257

CVE.ORG link : CVE-2018-12257

JSON object : View

Products Affected

apollotechnologiesinc

momentum_axel_720p
momentum_axel_720p_firmware

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2018-12257", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2018-06-12T18:29:00.537", "references": [{"url": "https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download."}, {"lang": "es", "value": "Se ha descubierto un problema en dispositivos Momentum Axel 720P 5.1.8. Hay una actualizaci\u00f3n de firmware personalizada autenticada mediante el secuestro de DNS. Un usuario root autenticado con acceso a la interfaz de l\u00ednea de comandos puede actualizar remotamente el firmware con una imagen personalizada debido a la falta de validaci\u00f3n SSL mediante el cambio de los servidores de nombre en /etc/resolv.conf en el servidor del atacante y sirviendo la respuesta HTTPS esperada que contiene nuevo firmware para que descargue el dispositivo."}], "lastModified": "2018-08-02T14:24:25.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apollotechnologiesinc:momentum_axel_720p_firmware:5.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E6C0B73-09F5-4564-95B1-8D6EE44510B6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:apollotechnologiesinc:momentum_axel_720p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BE5DCE62-31E9-4C78-A4E4-88000392C7A2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}