The Vizio TV is vulnerable to code execution using a malicious USB device drive-by attack. The Vizio TV does not appropriately segregate the internal web root and USB drive mount location. A threat actor can leverage this weakness to access custom web files including CGI files, that can be leveraged for code execution. A threat actor on the local network can walk up to a Vizio TV, insert a USB drive for a second, and walk away with platform-level code execution to launch further attacks on any connected network.
The researcher created a USB drive which contained a native executable payload, and a CGI file which executes the payload. A static bind shell and CGI file to execute the bind shell are placed on a USB drive.
The USB was inserted into the TV where it was mounted inside the web root. The researcher used the 'Cast All The Things' python library to cast the internal application to the TV, launching the CGI file, and executing the payload.
catt -d TestTV cast_site "http://127.0.0.1:12345/usbparts/sda1/bind.cgi"Once the script executed, the researcher was able to connect to the payload and execute commands as the root user on both the 2017 E50x-E1 and 2018 P65-F1.
The Vizio TV can be made to execute code from a malicious USB drive. The advisory states the TV does not appropriately segregate the internal web root from the USB drive mount location, so custom web files on the drive, including CGI files, become reachable and can be used for code execution.
The advisory describes a threat actor on the local network walking up to a Vizio TV, inserting a USB drive for a second, and walking away with platform level code execution. The drive holds a native executable payload and a CGI file that runs it.
The USB drive was mounted inside the TV web root. The researcher then used the Cast All The Things python library to cast the internal application to the TV, which launched the CGI file on the drive and executed a static bind shell. Commands then ran as the root user.
Advisory L9-44-477 lists the 2017 E50x-E1 with versions 6.0.31.4-2 and 10.0.31.4-2. The advisory notes the researcher achieved root level command execution on both the 2017 E50x-E1 and the 2018 P65-F1. Impact is listed as Unranked and the category is command injection.
The advisory states the position gives platform level code execution that can be used to launch further attacks on any connected network. The researcher connected back to the bind shell placed by the USB payload and ran commands as root on the TV.