Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway
Manufacturer: Patton LLC
Affected Version(s): <= 3.21.2-23021
Tested Version(s): 2.21.1-22041, 3.21.2-23021, 3.22.0-23083
Vulnerability Type: OS Command Injection (CWE-78)
Vulnerability Type: Improper Access Control (CWE-284)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2023-07-05
Public Disclosure: 2023-08-28
CVE Reference: CVE-2023-41109
Author of Advisory: Maurizio Ruchay, SySS GmbH



SmartNode SN200 is a VoIP appliance which is manufactured and
distributed by Patton LLC.

The manufacturer describes the product as follows (see [1]):

"The SmartNode 200 Series of VoIP Analog Telephone Adapter and VoIP Phone
Adapter Gateways support up to four telephone connections. VoIP Analog Phone
Adapter integrates legacy Phones and Fax machines into a UCC Environment.
High-quality voice and reliable fax over any IP network. All-IP does not end
when analog terminals have to be integrated. Security and quality guaranteed."

Due to an error in the authorization mechanism and improper input validation,
the device allows unauthenticated adversaries to execute OS commands via
the web interface.


Vulnerability Details:

SySS GmbH found an unauthenticated OS command injection vulnerability in
SmartNode 200 (SN200) devices.

The SN200 devices offer a "Network Diagnostic Commands" feature to
administrative users. This feature is designed to execute network diagnostic
commands like ping. However, as SySS GmbH discovered, the feature can be
used to execute arbitrary system commands.
Furthermore, a flaw in the authorization mechanism was found. This issue allows
unauthenticated adversaries to execute system commands via the affected feature.


Proof of Concept (PoC):

The following HTTP request shows how the system command "id" is executed
on the device:

POST /rest/xxxxxxxxxxxxxxx/xxxxxxx?executeAsync HTTP/1.1
Cookie: AuthToken=; AuthGroup=superuser; UserName=admin
[... shortened ...]
Connection: close


The following output from the web interface shows that the command has
been executed:

*** Command started ***
[... shortened ...]
uid=0(root) gid=0(root)

PING ( 56 data bytes
64 bytes from seq=0 ttl=64 time=1.025 ms
64 bytes from seq=1 ttl=64 time=1.781 ms

*** Command completed ***

Especially noteworthy is that an empty cookie "AuthToken" can be used in
order to bypass the authorization checks.

Since the vulnerability is still active, parts of the PoC have been redacted.



A patch for this issue is not yet available. Therefore, it is recommended to
disable the vulnerable "Network Diagnostic Commands" feature if possible.
Furthermore, it is advised to block network access to the HTTP interface
either on the device directly or via firewall.


Disclosure Timeline:

2023-06-28: Vulnerability discovered
2023-07-05: Vulnerability reported to manufacturer
2023-08-28: Public disclosure of vulnerability
2023-10-13: Vulnerability confirmation on the newly released update 3.22.0-23083



[1] Product website for SmartNode SN200
[2] OWASP OS Command Injection Defense Cheat Sheet
[3] SySS Responsible Disclosure Policy
[4] SySS Security Advisory SYSS-2023-019