CVE-2018-16596
Description
A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only possible if the attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again.
How to fix
- swisscom internet-box_standard_firmware09.04.00 or later
- swisscom internet-box_light_firmware08.05.02 or later
- swisscom internet-box_plus_firmware09.04.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| swisscom internet-box_standard_firmware | v < 09.04.00 | 09.04.00 |
| swisscom internet-box_light_firmware | v < 08.05.02 | 08.05.02 |
| swisscom internet-box_plus_firmware | v < 09.04.00 | 09.04.00 |
| swisscom internet-box_2_firmware | v ≤ 09.04.00 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.