""ET EXPLOIT Viessmann Vitogate 300 Command Injection Attempt (CVE-2023-5702)""

SID: 2051666

Revision: 1

Class Type: attempted-admin

Metadata: affected_product Viessmann_Vitogate, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_03_15, cve CVE_2023_5702, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_03_15, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/cgi-bin/vitogate.cgi"

  • Value: "|7b 22|method|22 3a 20 22|put|22 2c 20 22|form|22 3a 20 22|" Depth: 27

  • Value: "|22 2c 20 22|session|22 3a 20 22|"

  • Value: "|22 2c 20 22|params|22 3a 20 7b 22|ipaddr|22 3a 20 22|"

  • Value: "|3b|"

  • Value: "|22 7d 7d|"

  • Value: "Content-Type|3a 20|application/json"

Within: 50

PCRE:

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

source