CVE-2022-35270 - Denial of Service Vulnerability Discovered in Robustel R151 3.1.16 and 3.3.

A serious security vulnerability known as CVE-2022-35270 has been discovered in the web_server hashFirst functionality of Robustel R151 3.1.16 and 3.3.. This denial of service (DoS) vulnerability could enable an attacker to cause the affected device or software to crash, potentially disrupting vital services. By sending a specially-crafted network request to the device or software, an attacker can exploit this flaw and subsequently result in a denial of service. This particular issue is found in the /action/import_wireguard_cert_file/ API.

To demonstrate the exploitation of this vulnerability, consider the following code snippet

import requests

ip = "TARGET_IP_ADDRESS"
url = f"http://{ip}/action/import_wireguard_cert_file/";

data = {
    "hashFirst": "M" * 1024
}

response = requests.post(url, data=data, timeout=5)
print(response.status_code)

Replace TARGET_IP_ADDRESS with the IP address of the targeted Robustel R151 device. Here, the Python requests library is used to send a POST request with a malicious hashFirst value to the affected API.

Original References

1. CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35270
2. National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2022-35270

Exploit Details

The denial of service vulnerability (CVE-2022-35270) is triggered when an attacker sends a sequence of requests to the /action/import_wireguard_cert_file/ API. This can overwhelm the system and cause the device or software to crash, leading to a temporary or permanent denial of service.

To exploit this vulnerability, the attacker needs to know the targeted Robustel R151 device's IP address. Thus, it is essential to protect your devices from unauthorized access.

Mitigation Steps

Robustel, the manufacturer of R151 devices, needs to issue a security patch to address this vulnerability in their software. In the meantime, users can take precautionary measures to minimize the risk of exploitation:

1. Restrict network access: Limit access to the device's web interface to trusted IPs or networks only. This will significantly reduce the attack surface.

2. Update software: Keep the device's firmware up-to-date to minimize exposure to known vulnerabilities.

3. Monitor network activity: Regularly monitor network traffic for any signs of malicious activity, such as repetitive requests targeting the affected API.

4. Apply security best practices: Implement strong authentication and authorization mechanisms to strengthen the device's overall security posture.

Conclusion

CVE-2022-35270 is a critical denial of service vulnerability that affects the web_server hashFirst functionality of Robustel R151 3.1.16 and 3.3.. An attacker can exploit this vulnerability by sending a sequence of specially-crafted network requests to the device's /action/import_wireguard_cert_file/ API. Until an official security patch is made available, users should apply the suggested mitigation steps to minimize the risk of exploitation and ensure the security of their devices.

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 02/23/2023 23:53:00 UTC