UC-HTTPD: IoT Security Cam 1-days / n-days - Local File Disclosure + Buffer Overflow

PoC's here: https://github.com/MLT-0x539/Exploits/tree/main/uc-httpd

mnt/mtd/Config/Account1 == a logfile that shows recently-executed commands in addition to showing the full source code for any files opened on the server-side...
Originally published by my old exploit dev team (Project Insecurity LTD) back in 2017 (wrote 2019 bby accident in the video), prior to this it was an 0day. After we made the PoC public, full disclosure first resulted in mass exploitation by skids, but over time the number of publicly-exposed vuln devices dropped from around 3 million to under 90,000, so it eventually had the intended effect of reducing exposure through means of full disclosure :)
Sadly, it is impossible for the device manufacturers to actually patch these vulns without doing a mass product recall to gain physical access to the devices in order to manually update their firmware.

Видео UC-HTTPD: IoT Security Cam 1-days / n-days - Local File Disclosure + Buffer Overflow канала Bug0xF4