Smart-home controllers from German company AGFEO have adopted best practice internet things security by offering an unsecured Web admin interface.
The now-patched attack vectors included unauthenticated access to some services, authentication bypass, cross-site scripting (XSS) vulns, and hard-coded cryptographic keys.
The bugs were discovered by SEC Consult, and landed on Full Disclosure after the vendor finally released an update. The AGFEO ES 5xx and 6xx firmware has three certificates with their associated private keys, which would ultimately let an attacker get administrative credentials and do as they pleased. Why they'd work so hard, however, is a mystery, because you don't need credentials to p0wn the kit: the developers made a debugger Web service in the ES 5xx range, and forgot to remove it when the products shipped.
The advisory says the Web service is “accessible from an unusual port” (“They'll never think a Web service isn't running on port 80 will they!”), and it runs with root privileges. There's also a handy script to read files, meaning “al files on the operating system” are visible.
The configuration ports (TCP 19002, 19004, 19006, 19009, 19010, 19080, and 19081) are also wide open: “Multiple different instances of TCP services are present on the device”, the note says, all of which are forked from the debug/config service, letting attackers read device information and change configuration.
Because user names and passwords are stored in an SQLite database, the pwnage also lets an attacker dump credentials for all users. After being notified in January, AGFEO posted new firmware on June 30.
Download SafeUM — communicate privately, without advertising and spam.
