OS Command Injection in Xovis AG APS Devices

Executive Summary

This is an OS command injection vulnerability in Xovis AG sensor models APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B running firmware 2.10.1.1 or earlier. The flaw exists in the /sbin/ImportParamSet.sh script which processes symlinks from uploaded parameter archive files. The script embeds the symlink target path into a shell command without proper sanitization or quoting, allowing execution of arbitrary commands as root via the APC_SendMsg IPC mechanism.

Useful 0 Not Useful 0

Detection Guidance

Check if your Xovis devices are running firmware versions 2.10.1.1 or earlier. Inspect network traffic for unusual IPC commands or shell command executions from the ImportParamSet.sh script. Look for symlink-related activities in system logs or during parameter archive uploads.

Useful 0 Not Useful 0

Impact Analysis

An attacker with network access and even low-privilege read-only Web-UI access could exploit this to execute arbitrary commands as root on the affected Xovis sensors. This could lead to full system compromise, unauthorized data access, or disruption of sensor functionality. The impact includes potential loss of confidentiality, integrity, and availability of the device and its data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data collected by the sensors, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compromise of sensor integrity could also result in inaccurate data collection, undermining compliance with regulations requiring reliable data for safety or operational purposes.

Useful 0 Not Useful 0

Mitigation Strategies

Update all affected Xovis devices to firmware version 2.11 or later immediately. Restrict network access to the Web-UI to trusted users only. Monitor for unauthorized command execution attempts or unusual activity in system logs.

Useful 0 Not Useful 0