CVE-2019-3983 - Insufficient UART Protections
Exposed header pins allow serial connection to sync module which enables root access to the device with easily bypassed default credentials. A username of "root" and password of "willoXXX" where XXX is the last 3 digits of the serial number (readily available on outside of device) grants root access to the device.
CVSSv2 vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVE-2019-3984 - Command Injection via Sync Module Update
If DNS traffic from the sync module or camera is hijacked, these devices are vulnerable to command injection. The update scripts that retrieve updates remotely feed data directly to "os.execute()" without any validation. For example, hijacking the DNS lookups for the ".server" variable on our sync modules allows us to hijack requests intended for "<blink for home cloud endpoint>/fw/update_tls/<version number>" and return our own customized responses (such as "echo "Update hijacked." && id") which are then fed directly to "os.execute" within /root/apps/connection/start_get_sm_update.
CVSSv2 vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVE-2019-3985 - Command Injection via Wifi Controller Parameter (ssid)
When enrolling/onboarding devices, user-supplied input is not properly validated for the "ssid" parameter, which could lead to remote code execution as this input is fed directly to "os.execute()". For example, the existing sanitize functionality only attempts to escape quotes and command substitution characters. These mitigations are easily bypassed by adding extra backslashes to escape the sanitized slashes. For example, the following input bypasses the existing mitigations: test\" && dropbear && echo \"
CVSSv2 vector: (AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVE-2019-3986 - Command Injection via Wifi Controller Parameter (key)
When enrolling/onboarding devices, user-supplied input is not properly validated for the "key" parameter, which could lead to remote code execution as this input is fed directly to "os.execute()". For example, the existing sanitize functionality only attempts to escape quotes and command substitution characters. These mitigations are easily bypassed by adding extra backslashes to escape the sanitized slashes. For example, the following input bypasses the existing mitigations: test\" && dropbear && echo \"
CVSSv2 vector: (AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVE-2019-3987 - Command Injection via Wifi Controller Parameter (encryption)
When enrolling/onboarding devices, user-supplied input is not properly validated for the "encryption" parameter, which could lead to remote code execution as this input is fed directly to "os.execute()". For example, the existing sanitize functionality only attempts to escape quotes and command substitution characters. These mitigations are easily bypassed by adding extra backslashes to escape the sanitized slashes. For example, the following input bypasses the existing mitigations: test\" && dropbear && echo \"
CVSSv2 vector: (AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVE-2019-3988 - Command Injection via Wifi Controller Parameter (bssid)
When enrolling/onboarding devices, user-supplied input is not properly validated for the "bssid" parameter, which could lead to remote code execution as this input is fed directly to "os.execute()". For example, the existing sanitize functionality only attempts to escape quotes and command substitution characters. These mitigations are easily bypassed by adding extra backslashes to escape the sanitized slashes. For example, the following input bypasses the existing mitigations: test\" && dropbear && echo \"
CVSSv2 vector: (AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVE-2019-3989 - Command Injection via Auth Gen Script
If DNS traffic from the sync module or camera is hijacked, these devices are vulnerable to command injection. External output received by the "get_networks()" function in /root/apps/auth_gen/auth_gen is not properly validated prior to being fed directly to "os.execute()", which could lead to remote code execution as root.
CVSSv2 vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Outdated dnsmasq Version
The version of dnsmasq on the sync module appears to be 2.7.1, which is known to be vulnerable to several existing CVEs.