“The name length is limited to 30 characters or less, but this rule is only enforced by the app itself,” security researchers Amit Serper and Reuven Yakar said in a report shared with The Hacker News, adding the validation was not applied by the firmware code.
As a result, circumventing the character limit by using a Python module named pyWeMo can lead to a buffer overflow condition, which can then be reliably exploited to crash the device or, alternatively, trick the code into running malicious commands and take over control.
Belkin, in response to the findings, has said that it does not plan to address the flaw owing to the fact that the device is reaching end-of-life (EoL) and has been replaced by newer models.
“It appears that this vulnerability could be triggered via the Cloud interface (meaning, without a direct connection to the device),” the researchers cautioned.
In the absence of a fix, users of Wemo Mini Smart Plug V2 are recommended to avoid exposing them directly to the internet and ensure that appropriate segmentation measures are implemented if they have been deployed in sensitive networks.
“This is what happens when devices are shipped without any on-device protection. If you only rely on responsive security patching, as most device manufacturers do today, two things are certain: you will always be one step behind the attacker, and one day the patches will stop coming,” said Igal Zeifman, vice president of marketing for Sternum.
Talk to Cyber Security Company LoughTec today on how we can protect you from cyber-attacks with 24/7/365 real-time response. Book a demo by calling +44 (0) 2882 252 445 or emailing firstname.lastname@example.org.