TRENDnet TV-IP302PI 1.02.38 NTP field injects root commands
Original title: [0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H)
An authenticated NTP server-address reaches a shell-form system() call; the disclosure rates it 7.2 High.
0day Rubbish Research Team publicly disclosed an authenticated OS command-injection flaw in TRENDnet TV-IP302PI firmware 1.02.38, a closed-source US IP camera. The NTP server-address field is passed to a shell-form system() call and can run commands as root. The affected daemon is the stripped ARM binary /hunt/hunt_server. The snippet gives no CVE, patch, or confirmed attacks.
Unconfirmed: The snippet does not state a CVE, a fixed firmware, or whether attacks have occurred.
- The rating given is 7.2 High with PR:H.
- The binary is ARM 32-bit EABI5, 4.5 MB, dynamically linked and stripped.
- Posted to Full Disclosure on October 20.
Impact: Authenticated NTP input runs OS commands as root
| Product | Affected |
|---|---|
| TRENDnet TV-IP302PI | firmware 1.02.38 |
- Vendors
- TRENDnet
- Products
- TV-IP302PI
- Organizations
- 0day Rubbish Research Team
- Countries
- United States
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in TRENDnet TV-IP302PI firmware 1. 02. 38, the closed-source IP surveillance camera from TRENDnet (United States).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.