A heap overflow vulnerability exists in the 'HKProcessConfig' function that overflows inside the HKWAC object. This object is responsible for managing the HomeKit Wireless Access Control setup process. A threat actor can craft a malicious payload to control values inside the object, causing the ecobee3 device to connect to a separate WiFi access point. Given the nature of memory attacks, it may be possible to extend this attack further to achieve code execution.
The Wireless Access Configuration (WAC) server is present on the ecobee3 device on TCP port 1200. Usually this function is employed when connecting the device to a WiFi access point during initial setup via an iOS device. However, this service remains present after the device has been connected to a wireless network, leaving it vulnerable to attack.
A threat actor can send a POST request to the endpoint http://<host>:1200/config with a request body greater than 512 bytes, resulting in an overflow of the HKWAC object. The HKWAC object is provisioned with 604 bytes; a request larger than 604 bytes corrupts the next object on the heap, which could be a path to achieve code execution.
A payload greater than 512 but less than 604 bytes controls specific elements of the HKWAC object including flags used to validate whether previous steps of the WAC process are complete. By exploiting the structure, a threat actor can trick the ecobee3 into accepting a new WiFi access configuration, disconnecting it from the current access point and connecting it to a threat-actor-controlled access point. The payload did not require authentication and could potentially be used in CSRF attacks.