Data leakage and arbitrary remote code execution in Syrus cloud devices

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connected device. An attacker who knows the IP address of the server is able to connect and perform the following operations: * Get location data of the vehicle the device is connected to * Send CAN bus messages via the ECU module ( https://syrus.digitalcomtech.com/docs/ecu-1 https://syrus.digitalcomtech.com/docs/ecu-1 ) * Immobilize the vehicle via the safe-immobilizer module ( https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization ) * Get live video through the connected video camera * Send audio messages to the driver ( https://syrus.digitalcomtech.com/docs/system-tools#apx-tts https://syrus.digitalcomtech.com/docs/system-tools#apx-tts )

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

认证机制不恰当

Digital Communications Technologies Syrus 4G IoT 安全漏洞

Digital Communications Technologies Syrus 4G IoT是Digital Communications Technologies公司的一个用于车辆远程监控和物联网（IoT）应用的设备。 Digital Communications Technologies Syrus 4G IoT 存在安全漏洞，该漏洞源于可以利用不安全的 MQTT 服务器下载并执行任意命令，允许未经身份验证的远程攻击者在连接到云服务的任何 Syrus 4G 设备上执行代码。MQTT 服务器还会泄露

N/A

其他