Title: devolo dLAN 550 duo+ Starter Kit Remote Code Execution
Advisory ID: ZSL-2019-5508
Type: Remote/Local
Impact: System Access, DoS
Risk: (4/5)
Release Date: 03.02.2019

Summary

Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter which is a cost-effective and helpful networking alternative for any location without structured network wiring. Especially in buildings or residences lacking network cables or where updating the wiring would be expensive and complicated, Powerline adapters provide networking at high transmission rates.

Description

The devolo firmware has what seems to be a 'hidden' services which can be enabled by authenticated attacker via the the htmlmgr CGI script. This allows the attacker to start services that are deprecated or discontinued and achieve remote arbitrary code execution with root privileges.

Vendor

devolo AG - https://www.devolo.com

Affected Version

dLAN 500 AV Wireless+ 3.1.0-1 (i386)

Tested On

Linux 2.6.31

Vendor Status

[04.10.2017] Vulnerability discovered.
[11.10.2017] Vendor contacted via email.
[14.10.2017] No response from the vendor.
[15.10.2017] Second attempt - Vendor contacted via email.
[02.02.2019] No response from the vendor.
[03.02.2019] Public security advisory released.

PoC

devolo_rce.txt

Credits

Vulnerability discovered by Stefan Petrushevski - <stefan@zeroscience.mk>

References

[1] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5507.php
[2] https://www.exploit-db.com/exploits/46325
[3] https://packetstormsecurity.com/files/151527
[4] https://cxsecurity.com/issue/WLB-2019020038
[5] https://exchange.xforce.ibmcloud.com/vulnerabilities/156596

Changelog

[03.02.2019] - Initial release
[10.02.2019] - Added reference [2], [3], [4] and [5]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk