PoC command injection in BLE service of Norton Core Secure WiFi Router (CVE-2018-5234)

vendor:

Secure WiFi Router

by:

Exploit Database

8.0

CVSS

HIGH

Command Injection

CWE

Product Name: Secure WiFi Router

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: CVE-2018-5234

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: GNU/Linux

2018

PoC command injection in BLE service of Norton Core Secure WiFi Router (CVE-2018-5234)

This exploit is a proof-of-concept (PoC) command injection in the BLE service of Norton Core Secure WiFi Router. The exploit is demonstrated by using OS GNU/Linux, Bluetooth dongle adapter, and BlueZ utility. The exploit requires restarting the router to provide access to the engineering page, and then executing the PoC script as the root user with the command to be executed as an argument. After the script is successfully executed, the attacker can gain access to the device via SSH connection with root as the user and admin as the password.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# PoC command injection in BLE service of Norton Core Secure WiFi Router (CVE-2018-5234)

For more information read
[paper](https://embedi.com/blog/whos-watching-the-watchers-vol-ii-norton-core-secure-wifi-router).

To demonstrate the exploitation, we will use:
- OS GNU/Linux;
- Bluetooth dongle adapter;
- BlueZ utility (for testing Bluetooth connection).

In order to use the script, we will need to set all dependencies in a advance:

```shell
$ pip install -r ./requirements.txt
```

With the help of `BlueZ` utilities, we should ensure Bluetooth is enabled and
functions properly.

1. Restart the router to provide access to the engineering page.
2. Start the PoC on behalf of the root user (required for operating with
   Bluetooth) with the command on executing as an argument:

    ```shell
    $ ./ble_norton_core.py "/etc/init.d/dropbear start"
    ```

    After the script is successfully executed, we get access to the device via
    the SSH connection. We put `root` as a user and `admin` as password:

    ```shell
    $ ssh root@norton.core
    ```

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44574.zip