CVE-2017-3209

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.

El dron DBPOWER U818A WIFI quadcopter proporciona acceso FTP a través de su propio punto de acceso local y permite al usuario anónimo obtener permisos totales de archivo. El dron DBPOWER U818A WIFI quadcopter ejecuta un servidor FTP que, por defecto, permite el acceso anónimo sin contraseña y proporciona permisos de lectura/escritura totales en el sistema de archivos al usuario anónimo. Un usuario remoto en el rango del punto de acceso abierto en el dron podría emplear el usuario anónimo del servidor FTP para leer archivos arbitrarios, como imágenes y vídeos tomados por el dispositivo, o reemplazar archivos del sistema como /etc/shadow para obtener aún más acceso al dispositivo. Además, el dron DBPOWER U818A WIFI quadcopter emplea BusyBox 1.20.2, lanzado en 2012, que podría conte4ner otras vulnerabilidades conocidas de BusyBox.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-12-05 CVE Reserved
2018-07-24 CVE Published
2024-07-03 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-276: Incorrect Default Permissions
CWE-306: Missing Authentication for Critical Function

CAPEC

References (3)

URL	Tag	Source
https://dl.acm.org/citation.cfm?id=3139943	Third Party Advisory
https://www.kb.cert.org/vuls/id/334207	Third Party Advisory
https://www.securityfocus.com/bid/97564	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Dbpower Search vendor "Dbpower"	U818a Firmware Search vendor "Dbpower" for product "U818a Firmware"	-	-	Affected	in	Busybox Search vendor "Busybox"	Busybox Search vendor "Busybox" for product "Busybox"	-	-	Safe
Dbpower Search vendor "Dbpower"	U818a Firmware Search vendor "Dbpower" for product "U818a Firmware"	-	-	Affected	in	Dbpower Search vendor "Dbpower"	U818a Search vendor "Dbpower" for product "U818a"	-	-	Safe