CVE-2024-0939

published 2024-01-26

CVE-2024-0939: A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of…

Priority P1 79 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
byzoro	smart_s210_firmware	<= 2024-01-17	—
byzoro	smart_s210_management_platform	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /Tool/uploadfile.php↗

filename contents.php↗

command POST /Tool/uploadfile.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin↗

other body="Smart管理平台"↗

• → The exploit uploads a PHP webshell to /home/<random>.php via the txt_path parameter; monitor for GET requests to /home/*.php on Byzoro Smart S210 devices as a post-exploitation indicator ↗
• → Use FOFA query body="Smart管理平台" to identify exposed Byzoro Smart S210 Management Platform instances for asset discovery and attack surface monitoring ↗
• → The vulnerability is unauthenticated (PR:N, UI:N); no session or credentials are required — any POST to /Tool/uploadfile.php from an external IP should be treated as suspicious on affected devices ↗

• · The Nuclei template uses randomized filenames (rand_text_alpha(5)) and random integers for the math-based response matcher, meaning the uploaded webshell path (/home/<random>.php) will differ per scan run — static path-based detection rules must account for the wildcard pattern /home/*.php rather than a fixed filename ↗
• · Affected versions are only those up to firmware version 20240117; detections and mitigations should be scoped to Byzoro Smart S210 devices running firmware ≤ 20240117 ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434