[SMC Networks] Remote Code execution in SMC D3G0804W Router [CVE-2020-8087]

SMC Networks is a US-based company founded in 1972, historically known for developing network interface cards (NICs), hubs, and Ethernet switches, and more recently expanding into IoT solutions.

According to its official manual, the SMC Networks D3G0804W is defined as:

"A multimedia Gateway that delivers video, voice, and data for applications such as Home Security and Automation, and IPTV distribution. The Gateway is a versatile and robust all-in-one solution that makes it ideal for homes and businesses to connect their local-area network (LAN) to the Internet."

A quick query on Shodan revealed approximately 35,600 exposed devices online.

While analyzing the router's web management interface, I identified a vulnerability that allows an unauthenticated attacker to achieve full remote compromise of the device. The flaw stems from insufficient input validation in one of the diagnostic/connectivity test endpoints, which can be manipulated via HTTP Parameter Pollution (HPP) to execute arbitrary commands.

First, authenticate to the web portal using the default credentials. Once logged in, navigate to Troubleshooting > Diagnostic Tools to access the target diagnostic utilities.

This section includes an input field to specify a target domain or IP address for standard ICMP ping diagnostics.

Intercept the diagnostic ping request using Burp Suite. The baseline HTTP POST request targets the /goform/formSetDiagnosticToolsFmPing endpoint:

Downloading the payload:

While testing how the endpoint handles its parameters, we found that vlu_diagnostic_tools__ping_address is the only one that accepts values other than digits. However, the parameter rejects spaces, which prevents passing arguments to an injected command.

To work around this, we abuse HTTP parameter pollution: the parameter is submitted twice, and the firmware concatenates both occurrences with a space, effectively reconstructing the command line for us.

The injection is built as follows:

• - In the first vlu_diagnostic_tools__ping_address, we inject a pipe (|) followed by the wget command.

• - In the second vlu_diagnostic_tools__ping_address, we supply the URL of the r file, which contains our reverse shell.

• - A trailing # comments out the remainder of the original command, preventing syntax errors and discarding the parameters the firmware appends afterwards.

The content of ‘r' file

The file is successfully downloaded
Web server side:

Execution:

Following the same steps (parameter pollution) we can execute ‘/bin/sh ./r’

Reverse shell:

And finnally we got the reverse shell

Cheers! :)

Successful exploitation gives an attacker arbitrary command execution on the device with root privileges, since the vulnerable formSetDiagnosticToolsFmPing handler passes attacker-controlled input to a shell without sanitisation and the web server runs as root. The proof of concept above chains this into a fully interactive reverse shell.

This translates into complete compromise of the gateway:

• - Persistence and full device control — the attacker can modify the firmware configuration, add accounts, alter DNS settings, or install a permanent implant that survives across reboots.

• - Pivot into the internal network — the router sits at the boundary of the LAN, so root access exposes every host behind it, including the IP cameras, home-automation controllers and IPTV endpoints the device is marketed to serve.

• - Interception and manipulation of all traffic — with control over routing and DNS resolution, the attacker can passively capture or actively redirect any traffic traversing the gateway.

• - Loss of availability — the device can be bricked, rebooted at will, or enrolled into a botnet.

Given the number of internet-exposed units identified through Shodan, the flaw is exploitable at scale and requires no physical proximity to the target.