CVE-2020-27539

Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-written HTTP parser and builder. HTTP parser has a heap buffer overflow (OOB write). In default configuration camera parses responses only from HTTPS URLs from config file, so vulnerable code is unreachable and one more bug required to reach it.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:company:cs-c2shw_firmware:5.0.082.1:*:*:*:*:*:*:*

cpe:2.3:h:company:cs-c2shw:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-01-26 18:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-27539

Mitre link : CVE-2020-27539

CVE.ORG link : CVE-2020-27539

JSON object : View

Products Affected

company

cs-c2shw_firmware
cs-c2shw

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2020-27539", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-01-26T18:15:46.053", "references": [{"url": "https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-written HTTP parser and builder. HTTP parser has a heap buffer overflow (OOB write). In default configuration camera parses responses only from HTTPS URLs from config file, so vulnerable code is unreachable and one more bug required to reach it."}, {"lang": "es", "value": "Un desbordamiento de la pila con un an\u00e1lisis completo de la respuesta HTTP en Rostelecom CS-C2SHW versi\u00f3n 5.0.082.1. El servicio AgentUpdater posee un analizador y generador HTTP autoescrito. El analizador HTTP presenta un desbordamiento del b\u00fafer de la pila (escritura OOB). En la configuraci\u00f3n predeterminada, la c\u00e1mara analiza las respuestas solo de las URL HTTPS del archivo de configuraci\u00f3n, por lo que el c\u00f3digo vulnerable es inalcanzable y se requiere un error m\u00e1s para alcanzarlo"}], "lastModified": "2021-02-02T18:56:40.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:company:cs-c2shw_firmware:5.0.082.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA2108A4-A3BF-4ECE-99E7-9EE9233063EB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:company:cs-c2shw:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C1CC4768-6258-44B3-9290-AF21DDB6E728"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}