CVE-2023-45852
📋 TL;DR
This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands on Vitogate 300 devices by injecting shell metacharacters in JSON data. It affects Vitogate 300 version 2.1.3.0 and potentially earlier versions. Attackers can gain complete control of affected devices.
💻 Affected Systems
- Viessmann Vitogate 300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, pivot to internal networks, disrupt building automation systems, or cause physical damage to connected equipment.
Likely Case
Attackers gain remote code execution to install cryptocurrency miners, create botnet nodes, or steal sensitive building automation data.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Public exploit code is available showing simple HTTP POST requests with crafted JSON payloads. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html
Restart Required: No
Instructions:
Check Viessmann's connectivity portal for firmware updates. If available, download and apply the latest firmware following vendor instructions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Vitogate 300 devices from internet and restrict network access to authorized management systems only.
Web Interface Access Control
linuxBlock external access to port 80/443 on Vitogate devices using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Vitogate devices from untrusted networks
- Deploy web application firewall (WAF) rules to block requests containing shell metacharacters in JSON parameters
🔍 How to Verify
Check if Vulnerable:
Check if device responds to HTTP POST requests at /cgi-bin/vitogate.cgi with JSON containing shell metacharacters in ipaddr parameter. Use curl: curl -X POST http://device-ip/cgi-bin/vitogate.cgi -H 'Content-Type: application/json' -d '{"method":"put","params":{"ipaddr":";id"}}'Check Version:
Check web interface login page or device management interface for firmware version information.Verify Fix Applied:
Test the same exploit attempt after applying mitigations - it should return authentication error or fail to execute commands.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/vitogate.cgi with JSON data containing shell metacharacters (;, |, &, $, etc.)
- Unusual command execution in system logs
- Failed authentication attempts followed by successful command execution
Network Indicators:
- HTTP traffic to Vitogate devices containing shell metacharacters in POST data
- Unusual outbound connections from Vitogate devices
SIEM Query:
source="web_logs" AND uri="/cgi-bin/vitogate.cgi" AND method="POST" AND (data CONTAINS ";" OR data CONTAINS "|" OR data CONTAINS "&")