Remote code execution vulnerabilities uncovered in smart air fryer

guest · Apr 22, 2021

Remote code execution vulnerabilities uncovered in smart air fryer
The impacted vendor has not responded or fixed the security issues.
April 20, 2021
https://www.zdnet.com/article/remote-code-execution-vulnerabilities-uncovered-in-smart-air-fryer/

While targeting consumer products and executing an RCE may not have the same immediate impact as doing the same on a corporate network, it is still worth highlighting that just because a product we have in our home is considered 'smart,' it does not mean that it is safe.

On Monday, researchers from Cisco Talos revealed the discovery of two RCEs in the Cosori Smart Air Fryer, a Wi-Fi-connected kitchen product that leverages the internet to give users remote control over cooking temperature, times, and settings.
Click to expand...

The team tested the Cosori Smart 5.8-Quart Air Fryer CS158-AF (v.1.1.0) and discovered CVE-2020-28592 and CVE-2020-28593. The first vulnerability is caused by an unauthenticated backdoor and the second, a heap-based overflow issue -- both of which could be exploited via crafted traffic packets, although local access may be required for easier exploitation.

The vulnerabilities have now been disclosed without any fix.
Click to expand...

Cisco Talos: Vulnerability Spotlight: Remote code execution vulnerabilities in Cosori smart air fryer

TALOS-2020-1216 (CVE-2020-28592) and TALOS-2020-1217 (CVE-2020-28593) are remote code execution vulnerabilities that could allow an attacker to remotely inject code into the device. This could hypothetically allow an adversary to change temperatures, cooking times and settings on the air fryer, or start it without the user’s knowledge. The adversary must have physical access to the air fryer for some of these vulnerabilities to work.

An attacker could exploit these vulnerabilities by sending a specially crafted packet to the device that contains a unique JSON object, which would allow them to execute arbitrary code.
Click to expand...

Log in or Sign up

Remote code execution vulnerabilities uncovered in smart air fryer

guest Guest

Log in or Sign up

Remote code execution vulnerabilities uncovered in smart air fryer

guest Guest

Useful Searches