A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
Weakness
The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Universal_bacnet_router_firmware | Mbs-solutions | * | 6.0.1.0 (excluding) |
Extended Description
A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as “chicken bits”. They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.
Potential Mitigations
- The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.