# Talos Vulnerability Report

### TALOS-2022-1580

## Robustel R1510 sysupgrade firmware update vulnerability

##### October 14, 2022

##### CVE Number

CVE-2022-34845

##### SUMMARY

A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network packet can lead to arbitrary firmware update. An attacker can send a sequence of requests to trigger this vulnerability.

##### CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Robustel R1510 3.1.16
Robustel R1510 3.3.0

##### PRODUCT URLS

R1510 –

##### CVSSv3 SCORE

6.7 – CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

##### CWE

CWE-345 – Insufficient Verification of Data Authenticity

##### DETAILS

The R1510 is an industrial cellular router. It offers several advanced software features like an innovative use of Open VPN, Cloud management, data over-use guard, smart reboot and others.

The R1510 offers to the admin user the possibility of upgrading the firmware. The API `/action/import_firmware` is used to upload the firmware file. Then the `/ajax/system_upgrade_start/` API can be called. This function, eventually, will call the `sysupgrade` binary that will perform the actual firmware upgrade.

Here is the relevant portion of the `/ajax/system_upgrade_start/` API:

[…]
{
command[0] = “sysupgrade”;
command[1] = “-q”;
command[2] = FILENAME;
command[3] = 0;
void var_18;
_eval(command, 0, 0, &pid);
}
[…]

The `/ajax/system_upgrade_start/` API is a wrapper for executing `sysupgrade -q `. The `FILENAME` variable is set in the `/action/import_firmware` and has as value the pathname to the firmware file. The `sysupgrade` will perform the firmware upgrade, but with the current settings the binary does not check for any signature verification. This can lead to arbitrary firmware update.

##### TIMELINE

2022-07-13 – Vendor Disclosure
2022-10-14 – Public Release

##### Credit

Discovered by Francesco Benvenuto of Cisco Talos.

* * *

Vulnerability Reports Previous Report

TALOS-2022-1578Read More