CVE-2018-13861
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute system commands including rebooting devices via a simple HTTP GET request to a specific URL. It affects Touchpad/Trivum WebTouch Setup V9 systems running firmware version V2.53 build 13163 from April 6, 2018. Organizations using these specific home automation/control systems are at risk.
💻 Affected Systems
- Touchpad / Trivum WebTouch Setup V9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system disruption through repeated reboots causing denial of service, potential for other undocumented command execution leading to system compromise or data loss.
Likely Case
Service disruption through device reboots, potentially affecting connected home automation or control systems.
If Mitigated
No impact if proper network segmentation and access controls prevent external access to vulnerable endpoints.
🎯 Exploit Status
Exploitation requires only a web browser or curl command to send HTTP GET request to vulnerable endpoint. The advisory shows specific exploit path: /xml/system/control.xml?action=reboot
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: No
Instructions:
No official patch information available. Check with Trivum/Touchpad vendor for updated firmware versions beyond V2.53 build 13163.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to the WebTouch Setup interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Web Server Configuration
allBlock access to the vulnerable /xml/system/control.xml endpoint
LocationMatch "^/xml/system/control\.xml$"
Order deny,allow
Deny from all
🧯 If You Can't Patch
- Isolate the device on a separate VLAN with strict firewall rules preventing external and unnecessary internal access
- Implement network monitoring for requests to /xml/system/control.xml and alert on any access attempts
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://device_ip/xml/system/control.xml?action=reboot and check if device reboots. Use curl: curl -v 'http://device_ip/xml/system/control.xml?action=reboot'Check Version:
Check web interface or device administration panel for firmware version information. Typically accessible via http://device_ip/Verify Fix Applied:
Attempt the same exploit request after implementing workarounds - should receive access denied or connection refused📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /xml/system/control.xml with action parameters
- Unexpected system reboots or service restarts
Network Indicators:
- HTTP requests to /xml/system/control.xml?action=* from unauthorized sources
- Multiple reboot requests in short timeframes
SIEM Query:
source="web_logs" AND uri_path="/xml/system/control.xml" AND query_string="*action=*"