Konke Smart Plug Authentication Bypass Vulnerability

vendor:

Konke

by:

gamehacker&zixian

9,8

CVSS

CRITICAL

Authentication Bypass

287

CWE

Product Name: Konke

Affected Version From: K

Affected Version To: K

Patch Exists: YES

Related CWE: CVE-2014-7279

CPE: a:kankunit:konke

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2014

Konke Smart Plug Authentication Bypass Vulnerability

Konke is a smart Home Furnishing products in China, the product has a security vulnerability, an attacker could exploit the vulnerability to obtain equipment management authority. Konke Smart Plug open 23 port, we can telnet the 23 port, we can get root without password. Scan Konke using nmap scan the 23 port, open cmd telnet Konke's 23 port and now you are the root. It is a openwrt, you can use busybox do everything! You can use 'reboot' command to reboot Konke.

Mitigation:

Ensure that authentication is properly implemented and enforced.

Source

Exploit-DB raw data:

-----------------------------------------------------------------------
          Konke Smart Plug Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author      : gamehacker&zixian
Mail        : gh<gh@waloudong.org>&zixian<me@zixian.org>
Date        : Oct, 17-2014
Vendor      : http://www.kankunit.com/
Link        : http://www.kankunit.com/
Version     : K
CVE         : CVE-2014-7279
 
Exploit & p0c
_____________
 
    “Konke” is a smart Home Furnishing products (http://www.kankunit.com/) in China, the product has a security vulnerability, an attacker could exploit the vulnerability to obtain equipment management authority.


    Konke Smart Plug open 23 port，we can telnet the 23 port，we can get root without password.


    1、Scan Konke. you can use nmap scan the 23 port.
    2、open cmd telnet Konke's 23 port.
    3、now you are the root. it is a openwrt,you can use busybox do everything! you can use "reboot" command to reboot Konke.and so on……


_____________