[+] Credits: Ian Ling
[+] Website: iancaling.com
[+] Source: https://blog.iancaling.com/post/160596244178

Vendor:
=================
https://mimosa.co

Products:
======================
Access Points (e.g. A5) <2.2.3
Client Radios (e.g. C5) <=2.2.3
Backhaul Radios (e.g. B5) <=2.2.3

Vulnerability Types:
===================
Remote Command Execution (RCE), Denial of Service (DoS), Local File 
Disclosure, and Information Leakage

Vulnerability Details:
=====================

Mimosa Client (e.g. C5) and Backhaul (e.g. B5) models (<2.2.4) are 
vulnerable to multiple vulnerabilities, including local file disclosure, 
remote command execution (RCE), information leakage, and 
denial-of-service (DoS) vulnerabilities.

All vulnerabilities below affect versions <2.2.3, except for the last 
one (authenticated RCE #2), which also affects version =2.2.3.

Mimosa APas (<2.2.3) are also vulnerable to the MQTT information leakage 
vulnerability explained below.

--Information leakage in the web interface (leads to DoS): There is a 
page in the web interface that will show you the deviceas serial number, 
regardless of whether or not you have logged in. There is another page 
(also accessible without authenticating) that allows you to remotely 
factory reset the device simply by entering the serial number.

--Information leakage in the MQTT broker (leads to DoS): These devices 
run Mosquitto, a lightweight message broker, to send information between 
devices. By using the vendoras hard-coded credentials to connect to the 
broker on any device (whether it be an AP, Client, or Backhaul model), 
an attacker can view all the messages being sent between the devices. If 
an attacker connects to an AP, the AP will leak information about any 
clients connected to it, including the serial numbers, which can be used 
to remotely factory reset the clients.

--Unauthenticated remote command execution (RCE) in the MQTT broker 
(leads to DoS): By connecting to the MQTT broker on the wireless AP and 
a wireless client, an attacker can gather enough information to craft a 
command that reboots the client remotely when sent to the clientas MQTT 
broker. This command can be re-sent endlessly to act as a DoS attack on 
the client.

--Unauthenticated local file disclosure: In the deviceas web interface, 
there is a page that allows an attacker to use an unsanitized GET 
parameter to download files from the device as the root user. The 
attacker can download any file from the deviceas filesystem, including 
block device images. This can be used to view unsalted, MD5-hashed 
administrator passwords, which can then be cracked, giving the attacker 
full admin access to the deviceas web interface. This vulnerability can 
also be used to view the plaintext pre-shared key (PSK) for encrypted 
connections, or to view the deviceas serial number (which leads to DoS).

--Authenticated remote command execution #1: In the deviceas web 
interface, after logging in, there is a page that allows you to ping 
other hosts from the device and view the results. The user is allowed to 
specify which host to ping, but this variable is not sanitized 
server-side, which allows an attacker to pass a specially crafted string 
to execute shell commands as the root user.

--Authenticated remote command execution #2: On the backend of the 
deviceas web interface, there are more tests the user can run than just 
the ping test mentioned above. These other tests are not all shown on 
the webpage; some are only accessible by crafting a POST request with a 
program like cURL. There is one test accessible via cURL that does not 
properly sanitize user input, allowing an attacker to execute shell 
commands as the root user.


Disclosure Timeline:
===================================
2017/04/05 a Vendor notified of some of the above vulnerabilities
2017/04/05 a Vendor acknowledgement
2017/04/07 a Vendor notified of web interface RCE #1
2017/04/07 a Vendor acknowledges web interface RCE #1
2017/04/11 a Vendor releases patch for all vulnerabilities that were 
known at the time
2017/04/11 a Web interface RCE vulnerability #2 discovered and reported 
to vendor
2017/04/12 a Vendor acknowledges vulnerability
2017/05/12 a Public disclosure