CVE-2016-10312
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on affected Jensen Air:Link devices by injecting shell metacharacters into certain web form endpoints. Attackers can gain full control of the device without authentication. Organizations using these specific Air:Link 3G, 5000AC, and 59300 models are affected.
💻 Affected Systems
- Jensen Air:Link 3G (AL3G)
- Jensen Air:Link 5000AC (AL5000AC)
- Jensen Air:Link 59300 (AL59300)
📦 What is this software?
Al3g Firmware by Jensenofscandinavia
Al5000ac Firmware by Jensenofscandinavia
Al59300 Firmware by Jensenofscandinavia
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network pivot, data exfiltration, or deployment of persistent malware across connected systems.
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept traffic, or use device as attack platform.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests with shell metacharacters to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
Check with Jensen of Scandinavia for firmware updates. If unavailable, implement workarounds and consider device replacement.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to device web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Web Interface Disable
allDisable web interface if not required for operation
🧯 If You Can't Patch
- Segment affected devices on isolated VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to /goform/* endpoints
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or SSH. Test by sending crafted request to /goform/* endpoints (only in test environment).Check Version:
Check via web interface at http://device_ip/status.html or via SSH if enabledVerify Fix Applied:
Verify firmware version is updated beyond vulnerable versions. Test exploitation attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/* endpoints
- Shell command execution in web logs
- Failed authentication attempts followed by successful form submissions
Network Indicators:
- HTTP requests containing shell metacharacters (;, |, &, $, etc.) to /goform/* paths
- Unexpected outbound connections from device
SIEM Query:
source="web_logs" AND uri="/goform/*" AND (request CONTAINS ";" OR request CONTAINS "|" OR request CONTAINS "&")