e2openplugin OpenWebif 1.2.4 Code Execution

`Hello all,  
  
e2openplugin-OpenWebif is an open source web interface plugin for IP TVs  
and media centers. It is found in several IP TV software images and  
hardware products including the commercial Dreambox devices.  
  
  
A remote code injection vulnerability was found in the "key" HTTP GET  
parameter of the "/api/saveconfig" API call.  
  
Further analysis of the vulnerability can be found here:  
https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/  
  
The vulnerability allows remote code execution on hosts running the  
aforementioned plugin. Some devices affected also run the plugin under  
root privileges (e.g: Dreambox DM800 HD se), allowing for complete  
remote takeover of the host.  
  
This defect has been patched by the vendor with the git commit:  
09a050c8f04afd3bb4a14af98994be255aae10d9  
(https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/commit/09a050c8f04afd3bb4a14af98994be255aae10d9).  
  
Administrators of affected devices are strongly advised to update their  
running instance of e2openplugin-OpenWebif to the latest version of the  
code. An official release containing the fix has not been released yet.  
  
  
References:  
https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9807  
https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/  
  
Disclosure Timeline:  
Vendor Contact: June 21st, 2017  
CVE assignment: June 22nd, 2017  
Vendor Patch: September 15th, 2017  
Public Advisory: October 2nd, 2017  
  
  
Regards,  
--  
John Torakis  
  
Security Researcher  
CENSUS S.A.  
  
  
  
`