A heap overflow vulnerability exists in the 'HKProcessConfig' function that overflows inside the HKWAC object. This object is responsible for managing the HomeKit Wireless Access Control setup process. A threat actor can craft a malicious payload to control values inside the object, causing the ecobee3 device to connect to a separate WiFi access point. Given the nature of memory attacks, it may be possible to extend this attack further to achieve code execution.
The Wireless Access Configuration (WAC) server is present on the ecobee3 device on TCP port 1200. Usually this function is employed when connecting the device to a WiFi access point during initial setup via an iOS device. However, this service remains present after the device has been connected to a wireless network, leaving it vulnerable to attack.
A threat actor can send a POST request to the endpoint http://<host>:1200/config with a request body greater than 512 bytes, resulting in an overflow of the HKWAC object. The HKWAC object is provisioned with 604 bytes; a request larger than 604 bytes corrupts the next object on the heap, which could be a path to achieve code execution.
A payload greater than 512 but less than 604 bytes controls specific elements of the HKWAC object including flags used to validate whether previous steps of the WAC process are complete. By exploiting the structure, a threat actor can trick the ecobee3 into accepting a new WiFi access configuration, disconnecting it from the current access point and connecting it to a threat-actor-controlled access point. The payload did not require authentication and could potentially be used in CSRF attacks.
The ecobee3 lite heap overflow, advisory L9-15-330, is a heap-based buffer overflow in the HKProcessConfig function that overflows inside the HKWAC object. That object manages the HomeKit Wireless Access Control setup process. A crafted payload can control values inside it and make the ecobee3 connect to a separate WiFi access point.
Advisory L9-15-330 records the heap overflow against ecobee3 lite version 4.5.81.200 from vendor ecobee. It was first published on June 28, 2021 and last updated on January 22, 2024. Impact is listed as Unranked, and no other firmware version is named.
Yes. The advisory states the payload did not require authentication and could potentially be used in CSRF attacks. The Wireless Access Configuration server that handles the request listens on TCP port 1200, and the request is a POST to its /config endpoint.
A payload larger than 512 bytes but smaller than 604 bytes sets flags that mark earlier steps of the WAC process complete, which tricks the ecobee3 into accepting a new WiFi configuration and joining an access point the attacker controls. A request over 604 bytes corrupts the next object on the heap, which the advisory describes as a possible path to code execution.
The Wireless Access Configuration server is normally used when an iOS device connects the ecobee3 to a WiFi access point during initial setup. The advisory notes the service remains present after the device has been connected to a wireless network, which is what leaves it exposed to this attack.