« Volver al listado

CVE-2017-10722

Estado: ModificadaAlta (7.8)—

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too.

Leer descripción completaMostrar menos

The application uses a dynamic link library(DLL) called "avilib.dll" which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function "sendchangepass" which allows a user to change the Wi-Fi password on the device. This function calls a sub function "sub_75876EA0" at address 0x7587857C. The function determines which action to execute based on the parameters sent to it. The "sendchangepass" passes the datastring as the second argument which is the password we enter in the textbox and integer 2 as first argument. The rest of the 3 arguments are set to 0. The function "sub_75876EA0" at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 2, it jumps to 0x7587718C and proceeds from there to address 0x758771C2 which calculates the length of the data string passed as the first parameter.This length and the first argument are then passed to the address 0x7587726F which calls a memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ishekar — Endoscope Camera Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-10722",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-17T22:15:10.137",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Jun/8",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Jun/8",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too. The application uses a dynamic link library(DLL) called \"avilib.dll\" which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function \"sendchangepass\" which allows a user to change the Wi-Fi password on the device. This function calls a sub function \"sub_75876EA0\" at address 0x7587857C. The function determines which action to execute based on the parameters sent to it. The \"sendchangepass\" passes the datastring as the second argument which is the password we enter in the textbox and integer 2 as first argument. The rest of the 3 arguments are set to 0. The function \"sub_75876EA0\" at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 2, it jumps to 0x7587718C and proceeds from there to address 0x758771C2 which calculates the length of the data string passed as the first parameter.This length and the first argument are then passed to the address 0x7587726F which calls a memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow."
    },
    {
      "lang": "es",
      "value": "Recientemente, como parte de la investigación sobre dispositivos IoT en el firmware más reciente para el Endoscopio Shekar, la aplicación de escritorio utilizada para conectarse al dispositivo sufre un desbordamiento de pila si se le pasan más de 26 caracteres como contraseña del Wi-Fi. Esta aplicación está instalada en el dispositivo y un atacante que puede proporcionar la carga correcta puede ejecutar el código directamente en el sistema de usuario. Cualquier violación de este sistema puede permitir que un atacante tenga acceso a todos los datos a los que el usuario tiene acceso. La aplicación utiliza una biblioteca de enlace dinámico (DLL) llamada \"avilib.dll\", que es utilizada por la aplicación para enviar paquetes binarios al dispositivo que permiten controlarlo. Una de las acciones que proporciona la DLL es cambiar la contraseña en la función \"sendchangepass\" que le permite a un usuario cambiar la contraseña de Wi-Fi en el dispositivo. Esta función llama a una subfunción \"sub_75876EA0\" en la dirección 0x7587857C. La función determina cual acción ejecutar de acuerdo  los parámetros que se le envíen. El \"sendchangepass\" pasa la cadena de datos como segundo argumento, que es la contraseña que ingresamos en el cuadro de texto y el entero 2 como primer argumento. El resto de los 3 argumentos se establecen en 0. La función \"sub_75876EA0\" en la dirección 0x75876F19 utiliza el primer argumento recibido y determina hacia qué bloque saltar. Dado que el argumento pasado es 2, salta a 0x7587718C y procede de allí a la dirección 0x758771C2 que calcula la longitud de la cadena de datos pasada como primer parámetro. Esta longitud y el primer argumento son pasados a la dirección 0x7587726F que llama a la función memmove que usa una dirección de pila como destino donde se pasa la contraseña que escribimos, ya que la fuente y la longitud calculada anteriormente se pasan como el número de bytes a copiar, lo que conlleva a un desbordamiento de pila."
    }
  ],
  "lastModified": "2026-06-17T01:00:34.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ishekar:endoscope_camera_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D620235-1706-4284-A45B-308C32A8DB90"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ishekar:endoscope_camera:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "46805FDE-1451-44FF-86EF-B52C0A39F6ED"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}