CVE-2020-28593

Vulnerability

A hidden functionality (CWE-912) exists in the configuration server of the Cosori Smart 5.8-Quart Air Fryer CS158-AF running firmware version 1.1.0 [1]. The device runs an ESP-01E-based WiFi module that, during initial setup, operates as an access point and listens on TCP port 41234 for encrypted JSON commands [1]. All traffic is encrypted using a static, symmetric key (llwantaeskey1.01) and IV (llwantaesivv1.01) embedded in the firmware [1]. The setup protocol includes a field tcpDebugPort that, when set to a value other than "off", enables a debug backdoor that can execute arbitrary commands [1]. No authentication is required to send commands to this port [1].

Exploitation

An attacker with network access to the device during its setup phase (i.e., when the air fryer is broadcasting its own WiFi network) can send a crafted TCP packet to port 41234 [1]. The packet must be encrypted with the known static AES key and IV, and contain a JSON object that sets tcpDebugPort to a non-off value and includes malicious commands in the appropriate field [1]. No authentication, user interaction, or prior knowledge beyond the embedded cryptographic material is required [1]. The low attack complexity (CVSS:3.0/AV:N/AC:H) is due to the attacker needing to be on the same network segment during the brief setup window [1].

Impact

Successful exploitation allows the attacker to achieve arbitrary code execution on the device's ESP-01E module [1]. This grants the attacker the ability to fully control the appliance, exfiltrate sensitive data (such as WiFi credentials sent during setup), or use the device as a pivot point on the local network [1]. The impact on confidentiality, integrity, and availability is high [1].

Mitigation

As of the publication date (2021-04-15), no firmware patch has been released by Cosori to address this vulnerability [1]. The device remains at risk if it is placed into setup mode on an untrusted network. Until a fix is available, users should avoid connecting the air fryer to any network where an attacker could be present during the initial configuration process, and should ensure the device is not left in setup mode for longer than necessary [1]. The CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.