""ET EXPLOIT MiCasaVerde VeraLite - Remote Code Execution Inbound (CVE-2016-6255)""
SID: 2027489
Revision: 2
Class Type: attempted-admin
Metadata: attack_target IoT, created_at 2019_06_18, deployment Perimeter, malware_family Mirai, performance_impact Low, signature_severity Major, updated_at 2019_06_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: [$HTTP_PORTS,49451]
Flow: established,to_server
Contents:
-
Value: "POST /upnp/control/hag HTTP/" Depth: 28
-
Value: "SOAPAction|3a 20|"
-
Value: "urn|3a|schemas-micasaverde-org|3a|service|3a|HomeAutomationGateway|3a|1|23|RunLua"
-
Value: "|3c|Code|3e|os|2e|execute|28 60|"
Within: 67
PCRE:
Special Options: