Very High
CVE-2020-14511
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2020-14511
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series Routers (versions prior to 5.4).
Add Assessment
Ratings
-
Attacker ValueVery High
-
ExploitabilityMedium
Technical Analysis
The web server is a 32-bit, big-endian MIPS binary at /magicP/WebServer/webs.
The patch against the websSecurityHandler() function in webs is simplistic. If the cookie length is greater than the buffer size of 512 bytes, the function fails out:
char cookie[512]; /* snip */ if (wp->cookie != NULL) { cookie_len = strlen(wp->cookie); + if (512 < cookie_len) goto Fail; memset(cookie, 0, 512); strncpy(cookie, wp->cookie, cookie_len); cookie[cookie_len] = '\0'; }
The exploit mitigations on the binary are lacking:
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE No RELRO No canary found NX disabled No PIE No RPATH No RUNPATH 1226) Symbols No 0 17 webs.unpatched
No additional mitigations were enabled in the patched version. Funny enough, the binary still has debug symbols.
Exploitability seems high on this one, given the complete lack of mitigations. That said, you would not be able to copy null bytes with strncpy(3).
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- moxa
Products
- edr-g902 firmware,
- edr-g902-t firmware,
- edr-g903 firmware,
- edr-g903-t firmware
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
