CVE-2017-8331

Vulnerability

A command injection vulnerability exists in the Securifi Almond, Almond+, and Almond 2015 devices running firmware AL-R096. The goahead web server processes POST requests to add port forwarding rules. The ip_address parameter is concatenated into a string that is passed to the system() function at address 0x00437284, allowing arbitrary command execution. The affected binary is MIPS little-endian, and the vulnerable code path is in function sub_43C280 [1].

Exploitation

An attacker can send a crafted POST request to the device's web interface, likely without authentication, to set the ip_address parameter to a value containing shell metacharacters. For example, appending a command after a semicolon results in execution of that command on the device. The attacker must have network access to the device's management interface [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with root privileges on the device, leading to full compromise of the device. This can be used to modify configuration, exfiltrate data, or launch further attacks from the compromised device [1].

Mitigation

As of the publication date 2019-06-18, no official patch or firmware update has been released to address this vulnerability. Users should consider replacing affected devices with those that receive security updates or restrict network access to the management interface to trusted hosts only [1].