Remote Code Execution flaw reported in Viasat Satellite Modems
Take action: If you are using Viasat sattelite modems, check if they are auto-updated. If not, update them ASAP. Should be fairly easy fix.
Learn More
A vulnerability has been discovered in multiple Viasat satellite modem models, potentially exposing critical communications infrastructure to remote attacks.
The security flaw is tracked as CVE-2024-6198 (CVSS score from 7.7 to 9.8 depending on source), affects the "SNORE" web interface accessible through the device's LAN and OTA interfaces.
The vulnerability stems from a stack buffer overflow in the "SNORE" web interface running on lighttpd over TCP ports 3030 and 9882. The issue exists in the /usr/local/SNORE/index.cgi binary, where HTTP request processing occurs without proper bounds checking.
When handling GET, POST, or DELETE requests, the CGI implementation uses an unsafe call to sscanf() to extract variables from the URI, allowing attackers to overflow a fixed-size buffer by sending specially crafted HTTP requests. For example, a request to:
http://192.168.100.1:9882/snore/blackboxes/AAAAAAAA[512 times]AAAAAAThis overflow gives attackers control over program registers, enabling them to hijack execution flow and potentially execute arbitrary code. Despite the binary employing a non-executable stack, exploitation remains possible through return-oriented programming (ROP) techniques.
The following Viasat modem models are vulnerable:
- RM4100, RM4200, EM4100 (firmware versions below 3.8.0.4)
- RM5110, RM5111, RG1000, RG1100, EG1000, and EG1020 (firmware versions up to 4.3.0.1)
Viasat has released fixes in the following firmware versions:
- Version 3.8.0.4+ for RM4100, RM4200, and EM4100 models
- Version 4.3.0.2+ for RM5110, RM5111, RG1000, RG1100, EG1000, and EG1020 models
Users should ensure their devices are online to receive automatic updates from Viasat and verify the updated firmware version through the administrative interface.
