Overview
Furuno Voyage Data Recorder (VDR) VR-3000/VR-3000S and VR-7000 moduleserv firmware update utility fails to properly sanitize user-provided input and is vulnerable to arbitrary command execution with root privileges.
Description
According to the Furuno VDR product page, the VDR "records all crucial data to identify the cause of maritime casualty as well as contribute to the future prevention of the catastrophe of any kind." Multiple versions of Furuno VDR VR-3000/VR-3000S and VR-7000 contain a firmware update utility called moduleserv that listens on TCP port 10110. The moduleserv service fails to properly sanitize user-provided input, which an unauthenticated attacker may leverage to execute arbitrary commands with root privileges. For more information, refer to the blog post by IOActive. |
Impact
An unauthenticated attacker with network access to affected devices can execute arbitrary commands with root privileges. |
Solution
Apply an update
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C |
| Temporal | 6.2 | E:POC/RL:OF/RC:UR |
| Environmental | 1.8 | CDP:LM/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Ruben Santamarta of IOActive for reporting this vulnerability. Thanks to JPCERT/CC for coordinating with the vendor.
This document was written by Joel Land.
Other Information
| CVE IDs: | None |
| Date Public: | 2015-01-04 |
| Date First Published: | 2016-01-04 |
| Date Last Updated: | 2016-01-04 13:19 UTC |
| Document Revision: | 24 |