Kaikreuzer

Name of the Vulnerable Software and Affected Versions: openHAB versions prior to 2.5.12 openHAB versions prior to 3.0.1 Description: The issue allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from the file system through an XML external entity (XXE) attack. Responses to SSDP requests can be especially malicious. All add-ons that use SAX or JAXB parsing of externally received XML are potentially subject to this kind of attack. The following add-ons are potentially impacted: AvmFritz, BoseSoundtouch, DenonMarantz, DLinkSmarthome, Enigma2, FmiWeather, FSInternetRadio, Gce, Homematic, HPPrinter, IHC, Insteon, Onkyo, Roku, SamsungTV, Sonos, Tellstick, TR064, UPnPControl, Vitotronic, Wemo, YamahaReceiver, and XPath Tranformation. Recommendations: For openHAB versions prior to 2.5.12, update to version 2.5.12 or later to fix the vulnerability by a more strict configuration of the used XML parser. For openHAB versions prior to 3.0.1, update to version 3.0.1 or later to fix the vulnerability by a more strict configuration of the used XML parser.

**Name of the Vulnerable Software and Affected Versions** openHAB versions prior to 2.5.2 **Description** The issue allows a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2, all commands need to be whitelisted in a local file which cannot be changed via REST calls. **Recommendations** For versions prior to 2.5.2, update to version 2.5.2 or later to ensure that commands are whitelisted in a local file and cannot be changed via REST calls. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.