CVE-2018-4002

An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack,...

CVE-2018-3985

An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if an invalid query name is encountered, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacke...

CVE-2018-4030

An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any...

CVE-2018-4011

An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the "RDLENGTH" value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An unauthenticated...

PT-2019-10750 · Cujo · Cujo Smart Firewall

Name of the Vulnerable Software and Affected Versions: CUJO Smart Firewall version 7003 Description: The issue is related to an integer underflow vulnerability in the mdnscap binary. It occurs when parsing SRV records in an mDNS packet, where the RDLENGTH value is handled incorrectly. This leads ...

PT-2019-10743 · Cujo · Cujo Smart Firewall

Name of the Vulnerable Software and Affected Versions: CUJO Smart Firewall version 7003 Description: A heap overflow issue exists due to incorrect handling of string lengths when parsing character strings in mDNS resource records. This can lead to arbitrary code execution in the context of the...

CUJO Smart Firewall Denial of Service Vulnerability

CUJO Smart Firewall is a home smart firewall device from CUJO USA. A denial of service vulnerability exists in the mdnscap binary in the CUJO Smart Firewall using firmware version 7003, which stems from the program failing to securely handle compressed pointers when parsing labels in mDNS packets...

CUJO Smart Firewall Integer Overflow Vulnerability

CUJO Smart Firewall is a home smart firewall device from CUJO USA. An integer overflow vulnerability exists in the mdnscap binary in CUJO Smart Firewalls using firmware version 7003, which stems from the program failing to properly handle the 'RDLENGTH' value when parsing SRV records in mDNS...

CUJO Firewall User Enumeration / Authorization Bypass

TL;DR: Despite CUJO Firewall is a cute device and quite challenging to break from hardware hacking point of view... the APIs which are just a click away, once bypassed pinning and apk's obfuscation suffer of authorization bypass issues. An attacker could easily enumerate all existing users, and f...