The exploit exists in the devices server, alphapd, when processing
prior to displaying it to the user. If
WEPEncryption is provided in the
URL this leads to a buffer overflow if the value is longer than 0x28 bytes. A
URL of the form:
will exercise the exploit and begin executing at
Note: The exploit requires credentials to be successful. Default credentials are admin with a blank password.
Full exploit that takes advantage of a buffer overflow in the alphapd server to execute an arbitrary command on the device. It has been tested on the DCS-5020L with all available versions of the firmware as well as the most recent firmware of the DCS-930L. More devices and versions can be added by reading the comments in the overflow file. I might add more devices and versions as time permits, but it's not a high priority. The initial commit of this project has some simpler Python2 examples.
Below is the list of devices effected by this exploit. All versions of the firmware are currently vulnerable.
Live Vulnerable Devices
This project is written in Python 3 and will not execute under Python 2.
python3 exploit.py -i 192.168.0.100 -P 80 -u admin -p ""
https://www.youtube.com/watch?v=ijcbkY3dtso Skip to 13:15 to hear about the actual exploit.