CVE-2018-10544
📋 TL;DR
Meross MSS110 smart plugs contain an unauthenticated administrative interface at admin.htm, allowing attackers to gain full administrative control without credentials. This affects all users of MSS110 devices running firmware through version 1.1.24.
💻 Affected Systems
- Meross MSS110 Smart Wi-Fi Plug Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to reconfigure device settings, intercept network traffic, or use the device as a foothold for lateral movement within the network.
Likely Case
Attackers gain administrative access to smart plugs, potentially enabling them to control power states, monitor energy usage, or access other network resources.
If Mitigated
With proper network segmentation and access controls, impact is limited to the smart plug device itself without network lateral movement.
🎯 Exploit Status
Exploitation requires only web browser access to the admin.htm page. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider replacing affected devices or implementing network-level controls.
🔧 Temporary Workarounds
Network Segmentation
allIsolate smart plug devices on separate VLAN or network segment with restricted access
Firewall Rules
allBlock external access to smart plug web interfaces and restrict internal access
🧯 If You Can't Patch
- Remove devices from internet-facing networks and place behind firewalls
- Monitor network traffic to/from smart plug devices for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Access http://[device-ip]/admin.htm in browser. If accessible without authentication, device is vulnerable.Check Version:
Check device firmware version via Meross app or web interfaceVerify Fix Applied:
Check if admin.htm page requires authentication or returns 404/403 error📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to admin.htm page
- Multiple failed authentication attempts followed by successful admin access
Network Indicators:
- HTTP GET requests to /admin.htm from unauthorized sources
- Unusual traffic patterns to smart plug devices
SIEM Query:
source_ip=* dest_ip=[device_ip] uri_path="/admin.htm"