Remy

Insufficient validation of the ACME challenge token against RFC 8555 during challenge-file handling allows a maliciously crafted token to influence local path or filename usage. An attacker capable of supplying ACME challenge responses—such as through a compromised CA endpoint or by tampering with the response path—can achieve unauthorized file write and path traversal effects. This typically occurs with elevated privileges and can lead to remote command injection. This is an instance of External Control of File Name or Path, where an external input determines the path used by the application.

A weak credential issue exists, allowing a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID.

Multiple authenticated operating system (OS) command injection vulnerabilities exist in the software. A physically close attacker that is authenticated to the Bluetooth Low-Energy (BTLE) interface can use the network configuration service to inject commands in various configuration parameters, including `networkConfig.Interface.Phy.Eth0.Extra.PingTestIP`, `networkConfig.Interface.Phy.Eth0.Extra.DNSTestDomain`, and `networkConfig.Interface.Phy.Eth0.Gateway6`. Additionally, because the configuration can be synced to the Firewalla cloud, the attacker may be able to persist access even after hardware resets and firmware re-flashes.