[FD] Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon 
Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries). The research is 
published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

Vicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, 
VII.NVR.Host.exe Windows service) bound to /NVR/api/v1 on ports 8084/8444. The 
endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a 
[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes 
Process.Start. None of the 8 OWIN middlewares perform authentication, 
UpgradesController is not annotated with [Authorize], and SetupExecuteCommand 
bypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() 
method. The service runs as LocalSystem, so an unauthenticated attacker with 
network access to the Web API port immediately obtains nt authority\system 
remote code execution.

Impact: Full host compromise as nt authority\system with no credentials 
required; the attacker can access all recorded video, camera credentials, and 
VMS configuration, alter video surveillance state, and tamper with or destroy 
evidence.

Advisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/