Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon 
Industries). The research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

Vicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to 
/NVR/api/v1 on ports 8084/8444. The endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a 
[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes Process.Start. None of the 8 OWIN 
middlewares perform authentication, UpgradesController is not annotated with [Authorize], and SetupExecuteCommand 
bypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() method. The service runs as LocalSystem, 
so an unauthenticated attacker with network access to the Web API port immediately obtains nt authority\system remote 
code execution.

Impact: Full host compromise as nt authority\system with no credentials required; the attacker can access all recorded 
video, camera credentials, and VMS configuration, alter video surveillance state, and tamper with or destroy evidence.

Advisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/