cbcvebase.
CVE-2018-10123
published 2018-05-16

CVE-2018-10123: p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100.

PriorityP266high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
10.89%
95.3th percentile
p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100.

Affected

1 ranges
VendorProductVersion rangeFixed in
intenogroupiopsys_firmware2.0 – 4.2.0—

Detection & IOCsextracted from sources · hover to see the quote

port9100↗
path/etc/dropbear/authorized_keys↗
  • →Monitor for inbound TCP connections to port 9100 on IOPSYS devices from untrusted/external sources, which may indicate exploitation of the p910nd print daemon to read or write arbitrary files. ↗
  • →Detect ubus calls that set the p910nd 'device' configuration value to a non-printer path (e.g. /etc/init.d/p910nd or /etc/dropbear/authorized_keys) — this is the exploit setup step that redirects the print daemon to a sensitive file. ↗
  • →Alert on p910nd being enabled with 'interface' set to 'lan', which exposes the print daemon to the local network and is a prerequisite for exploitation. ↗
  • →Watch for data being sent to TCP port 9100 followed by a ubus uci commit for config 'p910nd' — this sequence matches the exploit's payload delivery and trigger pattern. ↗
  • ·The exploit requires prior authenticated access (valid ubus credentials) to configure p910nd before the unauthenticated TCP port 9100 file-write step; detection should cover both the authenticated config-change phase and the raw TCP data-send phase. ↗
  • ·The attacker cleans up after exploitation by resetting the p910nd device back to /dev/usb/lp0 and disabling the service, so post-exploitation forensic artefacts on the device config may be absent. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.