Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Some models have different open port for webserver with root fs (7983) #1

Open
brozkeff opened this issue Nov 28, 2020 · 4 comments
Open

Some models have different open port for webserver with root fs (7983) #1

brozkeff opened this issue Nov 28, 2020 · 4 comments
Labels
bug Something isn't working wontfix This will not be worked on

Comments

@brozkeff
Copy link

brozkeff commented Nov 28, 2020 •
edited
Loading

Related to https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-009.md / CVE-2020-27403

Tested on TCL U43P6064 with Android 8.0 (version 501 or something like that, cannot find the exact version on the TV anymore). Installed f-droid on the TV and NetworkMapper (nmap) and scanned all ports on localhost (127.0.0.1). Serveral open ports, and port 7983 contained the same http server with the entire fs available for free. Any app could this way access anything, bypassing all security.
Not binded to wifi ip address, however, perhaps already fixed remotely by TCL. Localhost binding still present and several other services available via localhost as well: particularly nmap found these open ports bound to 127.0.0.1 with 7983/tcp (http) containing the webserver with the filesystem.

Open TCP ports found via nmap:

  • 6553
  • 53130
  • 10101
  • 12854
  • 8009
  • 8008
  • 8443
  • 6466
  • 6467
  • 9080
  • 7983 - http, entire filesystem freely accessible
  • 6557
  • 9000
  • 6550
  • 8012
  • 6559
  • 4332

Some data returned but fingerprint not detected by nmap:

  • 6550 (TLSSessionReq...)
  • 6559 (tv_start=>390=>-3=>tv_end)
  • 8009 (received some self-signed RSA-2048 cert)
  • 9080 (http, Server: NRDP/2020.1.3.1)
@brozkeff
Copy link
Author

IMG_20201128_215524
Proof. Edge browser (unprivileged app) on TV opening webserver with entire fs at its fingertips

@sickcodes sickcodes added bug Something isn't working wontfix This will not be worked on labels Nov 29, 2020
@brozkeff
Copy link
Author

Confirmed vulnerability not just from localhost but also from LAN.

Discovered SQlite db of supported TV models of the FW.

Whopping 235 models of TVs are probably affected, branded TCL, Thomson and others:

ClientType ModelName
TCL-EU-MT58K-S1 L55E5700A-UD
TCL-EU-MT58K-S1 U55S896
TCL-EU-MT58K-S1 U65S996
TCL-EU-MT58K-S1 U40S696
TCL-EU-MT58K-S1 U55S896
TCL-EU-MT58K-S1 U40S696
TCL-EU-MT58K-S1 U50S796
TCL-AP-MT58K-S1 65X1QUS
TCL-AU-MT5658-S1 65X1QUS
TCL-LA-MT5658-S1 55P1US
TCL-LA-MT5658-S1 75C2US
TCL-EU-MT58K-S1 U65S996
TCL-CA-MT58CF-S1 55P1MUS
THOM-EU-MT58K-S1 55UC646
THOM-EU-MT58K-S1 49UC646
THOM-EU-MT58K-S1 43UC646
TCL-EU-MT58K-S1 U49P606
TCL-EU-MT58K-S1 U55P606
THOM-EU-MT58K-S1 65UC646
TCL-EU-MT58K-S1 U65P606
TCL-EU-MT58K-S1 U43P606
TCL-AP-MT58K-S1 55C2US
TCL-AP-MT58K-S1 55C2US
TCL-ME-MT58K-S1 55C2US
TCL-AP-MT58K-S1 49C2US
TCL-AP-MT58K-S1 49C2US
TCL-ME-MT58K-S1 49C2US
TCL-AP-MT58K-S1 65C2US
TCL-AP-MT58K-S1 65C2US
TCL-ME-MT58K-S1 65C2US
TCL-EU-MT58K-S1 U49C706
TCL-EU-MT58K-S1 U55C706
TCL-EU-MT58K-S1 U65C706
TCL-AU-MT5658-S1 49C2US
TCL-AU-MT5658-S1 55C2US
TCL-AU-MT5658-S1 65C2US
THOM-EU-MT58K-S1 55UC656
THOM-EU-MT58K-S1 65UC656
TCL-AU-MT5658-S1 50P20US
TCL-AU-MT5658-S1 55P20US
TCL-AU-MT5658-S1 60P20US
TCL-AU-MT5658-S1 65P20US
TCL-LA-MT5658-S1 49C2US
TCL-LA-MT5658-S1 55C2US
TCL-LA-MT5658-S1 65C2US
TCL-CA-MT58CF-S1 49C2US
TCL-CA-MT58CF-S1 55C2US
TCL-EU-MT58K-S1 U43P646
THOM-EU-MT58K-S1 43UC646
TCL-AP-MT58K-S1 55X3US
TCL-AP-MT58K-S1 55X3US
TCL-ME-MT58K-S1 55X3US
TCL-AP-MT58K-S1 65X3US
TCL-AP-MT58K-S1 65X3US
TCL-ME-MT58K-S1 65X3US
THOM-EU-MT58K-S1 49UC766
THOM-EU-MT58K-S1 55UC766
THOM-EU-MT58K-S1 65UC766
TCL-CA-MT58CF-S1 55C2US
TCL-LA-MT5658-S1 65X3CUS
TCL-AU-MT5658-S1 55X2US
TCL-AU-MT5658-S1 65X2US
TCL-AU-MT5658-S1 75C2US
TCL-EU-MT58K-S1 U55X906
TCL-EU-MT58K-S1 U65X906
TCL-LA-MT5658-S1 75C2US
TCL-EU-MT58K-S1 U50P606
THOM-EU-MT58K-S1 65UC646
TCL-EU-MT58K-S1 U65P606
TCL-AP-MT58K-S1 L55P2MUS
TCL-EU-MT58K-S1 U55C706
THOM-EU-MT58K-S1 55UC656
TCL-EU-MT58K-S1 U75C706
TCL-EU-MT58K-S1 U60P606
TCL-EU-MT58K-S1 U49S706
TCL-EU-MT58K-S1 U55S706
TCL-EU-MT58K-S1 U65S706
THOM-EU-MT58K-S1 50UC646
TCL-EU-MT58K-S1 U49C706
TCL-CA-MT58CF-S1 55C2US
TCL-CA-MT58CF-S1 49C2US
TCL-LA-MT5658-S1 49C2US
TCL-AP-MT58K-S1 49C2US
TCL-ME-MT58K-S1 49C2US
TCL-AP-MT58K-S1 49C2US
TCL-AU-MT5658-S1 65P20US
TCL-ME-MT58K-S1 75C2US
THOM-EU-MT58K-S1 65UC766
TCL-EU-MT58K-S1 U65S706
TCL-AP-MT58K-S1 55C2US
TCL-AP-MT58K-S1 55C2US
TCL-ME-MT58K-S1 55C2US
TCL-AP-MT58K-S1 L65P2MUS
TCL-AU-MT5658-S1 55C2US
TCL-LA-MT5658-S1 55C2US
TCL-AU-MT5658-S1 49C2US
THOM-EU-MT58K-S1 55UC656
TCL-LA-MT5658-S1 49C2US
TCL-AU-MT5658-S1 55X2US
TCL-AU-MT5658-S1 70C2US
TCL-AP-MT58K-S1 75C2US
TCL-LA-MT5658-S1 49C2US
TCL-ME-MT58K-S1 70C2US
TCL-ME-MT58K-S1 U49C706
TCL-ME-MT58K-S1 U65C706
TCL-AU-MT5658-S1 65C2US
TCL-LA-MT5658-S1 65C2US
TCL-AP-MT58K-S1 I49
TCL-AP-MT58K-S1 I55
TCL-ME-MT58K-S1 65X3US
TCL-AP-MT58K-S1 65C2US
TCL-AP-MT58K-S1 65C2US
TCL-ME-MT58K-S1 65C2US
TCL-EU-MT58K-S1 U65C706
TCL-ME-MT58K-S1 75C2US
TCL-LA-MT5658-S1 49C2US
TCL-LA-MT5658-S1 55C2US
TCL-LA-MT5658-S1 65X3CUS
TCL-LA-MT5658-S1 75C2US
TCL-AU-MT5658-S1 60P20US
TCL-ME-MT58K-S1 U65X906
TCL-AU-MT5658-S1 65P20US
TCL-EU-MT58K-S1 U55P606
TCL-EU-MT58K-S1 U65P606
TCL-ME-MT58K-S1 U49C706
TCL-ME-MT58K-S1 U55C706
TCL-EU-MT58K-S1 50DP660*
TCL-EU-MT58K-S1 55DP660*
TCL-AP-MT58K-S1 55C2US
TCL-AU-MT5658-S1 65E17NUS
TCL-AU-MT5658-S1 55E17NUS
TCL-AU-MT5658-S1 85X6US
TCL-AU-MT5658-S1 55P6US
TCL-ME-MT58K-S1 U65C706
TCL-AP-MT58K-S1 50P6US
TCL-AU-MT5658-S1 50P6US
TCL-AU-MT5658-S1 65P6US
TCL-AP-MT58K-S1 55P6US
TCL-EU-MT58K-S1 U55P606
THOM-EU-MT58K-S1 55UC646
TCL-EU-MT58K-S1 85X6US
TCL-EU-MT58K-S1 55V6
TCL-EU-MT58K-S1 65DP660
TCL-AU-MT5658-S1 85X6US
TCL-ME-MT58K-S1 85X6US
TCL-AU-MT5658-S1 49C6US
TCL-AU-MT5658-S1 55C6US/55C8
TCL-AU-MT5658-S1 65C6US
TCL-AU-MT5658-S1 70C4US
TCL-AU-MT5658-S1 75C4US
TCL-AU-MT5658-S1 65X4US
TCL-AU-MT5658-S1 55X4US/55X7
TCL-EU-MT58K-S1 U70C70*6
TCL-LA-MT5658-S1 85X6US
THOM-EU-MT58K-S1 55UC6596
TCL-AP-MT58K-S1 55X4US
TCL-AP-MT58K-S1 65X4US
TCL-AP-MT58K-S1 55K2A
TCL-AU-MT5658-S1 60C4US
TCL-AP-MT58K-S1 85X6US
TCL-AP-MT58K-S1 65X4US
TCL-AP-MT58K-S1 55X4US
TCL-AU-MT5658-S1 60P20US
TCL-AP-MT58K-S1 L55P2MUS
TCL-LA-MT5658-S1 55C6US
TCL-LA-MT5658-S1 49C6US
TCL-AP-MT58K-S1 49C6US
TCL-AP-MT58K-S1 49C6US
TCL-ME-MT58K-S1 49C6US
TCL-AP-MT58K-S1 55C6US/55C6
TCL-AP-MT58K-S1 55C6US
TCL-ME-MT58K-S1 55C6US
TCL-AU-MT5658-S1 60P4US
TCL-ME-MT58K-S1 65X3US
TCL-EU-MT58K-S1 55DC760
TCL-EU-MT58K-S1 65DC760
THOM-EU-MT58K-S1 55UD6406
THOM-EU-MT58K-S1 50UD6406
THOM-EU-MT58K-S1 43UD6406
TCL-AP-MT58K-S1 65C6US
TCL-AP-MT58K-S1 65C6US
TCL-ME-MT58K-S1 65C6US
TCL-LA-MT5658-S1 65C6US
TCL-AP-MT58K-S1 75C2US
TCL-AP-MT58K-S1 65X2US
TCL-AP-MT58K-S1 65X4US
TCL-ME-MT58K-S1 65X4US
TCL-AP-MT58K-S1 55X4US
TCL-ME-MT58K-S1 55X4US
TCL-AP-MT58K-S1 75C2US
TCL-AP-MT58K-S1 75C2US
TCL-ME-MT58K-S1 75C2US
TCL-LA-MT5658-S1 75C2US
TCL-EU-MT58K-S1 U75C7006
TCL-AU-MT5658-S1 75C4US/75C8
TCL-AP-MT58K-S1 65H2A
TCL-AP-MT58K-S1 75H2A
TCL-AP-MT58K-S1 65X4U
TCL-AP-MT58K-S1 43P65US/43P8M
TCL-EU-MT58K-S1 65P5
TCL-EU-MT58K-S1 75X5
THOM-EU-MT58K-S1 65UD6406
TCL-ME-MT58K-S1 65C2US
THOM-EU-MT58K-S1 50UD6406
TCL-AP-MT58K-S1 65C6US
TCL-AP-MT58K-S1 50P65US
TCL-AP-MT58K-S1 55C6US
TCL-AP-MT58K-S1 65K2A
TCL-AP-MT58K-S1 75H2A
TCL-AP-MT58K-S1 75C2US
TCL-CA-MT58CF-S1 55P6US
TCL-ME-MT58K-S1 55C6US
TCL-AU-MT5658-S1 70C4US
TCL-ME-MT58K-S1 65C6US
TCL-AU-MT5658-S1 65C6US/65C8
TCL-ME-MT58K-S1 65C6US
TCL-AP-MT58K-S1 65C6US/65C6
TCL-ME-MT58K-S1 65C6US
TCL-EU-MT58K-S1 65DC760
TCL-ME-MT58K-S1 75C2US
TCL-AU-MT5658-S1 65P6US
TCL-CA-MT58CF-S1 55C6US
TCL-CA-MT58CF-S1 65C6US
TCL-EU-MT58K-S1 65DP660
TCL-AU-MT5658-S1 65X8
TCL-AU-MT5658-S1 75P8M
TCL-LA-MT5658-S1 55C6US
TCL-LA-MT5658-S1 65C6US
TCL-AP-MT58K-S1 65X4US/65V2A
TCL-AU-MT5658-S1 65X7
TCL-AP-MT58K-S1 65X4US
TCL-AP-MT58K-S1 65V2A
TCL-AU-MT5658-S1 70P8M
TCL-AU-MT5658-S1 85P8M
TCL-AP-MT58K-S1 85P8M

@sickcodes
Copy link
Owner

Thanks I have forwarded to VP of TCL USA & Engineering team as the Security team hasn't been invented yet.

@sickcodes
Copy link
Owner

Closing out since this was fixed, see https://www.tcl.com/global/en/news/alert-vulnerabilities-found-in-tcl-android-tvs.html

@sickcodes sickcodes reopened this Feb 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working wontfix This will not be worked on
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@brozkeff @sickcodes