CVE-2017-16934

published 2017-11-24

CVE-2017-16934: The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a…

Priority P2 75 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter.

Detection & IOCs extracted from sources · hover to see the quote

url /default/en_US/frame.html?content=/dev/mtdblock/5↗

url /default/en_US/change_password.csp↗

path /dev/mtdblock/5↗

command <%%25call system.exec:↗

path /tmp/y↗

path /tmp/p↗

command /bin/busybox telnetd -l /bin/sh -p 23↗

port 1337↗

filename prism↗

• → Detect LFI exploitation attempt: HTTP GET requests containing 'content=/dev/mtdblock/5' in the query string targeting frame.html, which leaks the device configuration including admin credentials. ↗
• → Detect RCE exploitation attempt: HTTP POST requests to change_password.csp with a passwd parameter containing the '<%' or 'call system.exec:' injection string. ↗
• → Detect chained attack: HTTP Basic Authentication header ('Authorization: Basic') on POST requests to change_password.csp immediately following a GET to frame.html?content=/dev/mtdblock/5 from the same source IP. ↗
• → Detect payload staging: HTTP GET requests for a path named '/prism' served from an attacker-controlled HTTP server, used to deliver an ARM v5l binary implant to the target device. ↗
• → Detect post-exploitation: presence of telnetd spawned by busybox on port 23 with /bin/sh as the login shell on DBLTek GoIP devices. ↗
• → Monitor for the variable 'ADMIN_PASSWORD' being extracted via regex from the mtdblock/5 configuration dump, indicating credential harvesting from the device flash. ↗

• · DblTek has released patches addressing both vulnerabilities; detection rules should still fire on unpatched devices or exploitation attempts against them. ↗
• · The embedded ARM v5l binary payload ('PRISM') has its C2 host and port patched in at offsets 0x7810 and 0x7820 respectively at runtime, meaning the binary hash will differ per attacker infrastructure. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78