Serious Unpatched Vulnerability Uncovered in Popular Belkin Wemo Smart Plugs
17.5.23  Vulnerebility  The Hacker News

The second generation version of Belkin's Wemo Mini Smart Plug has been found to contain a buffer overflow vulnerability that could be weaponized by a threat actor to inject arbitrary commands remotely.

The issue, assigned the identifier CVE-2023-27217, was discovered and reported to Belkin on January 9, 2023, by Israeli IoT security company Sternum, which reverse-engineered the device and gained firmware access.

Wemo Mini Smart Plug V2 (F7C063) offers convenient remote control, allowing users to turn electronic devices on or off using a companion app installed on a smartphone or tablet.

The heart of the problem lies in a feature that makes it possible to rename the smart plug to a more "FriendlyName." The default name assigned is "Wemo mini 6E9."

Wemo Smart Plugs
"The name length is limited to 30 characters or less, but this rule is only enforced by the app itself," security researchers Amit Serper and Reuven Yakar said in a report shared with The Hacker News, adding the validation was not applied by the firmware code.

As a result, circumventing the character limit by using a Python module named pyWeMo can lead to a buffer overflow condition, which can then be reliably exploited to crash the device or, alternatively, trick the code into running malicious commands and take over control.

Belkin, in response to the findings, has said that it does not plan to address the flaw owing to the fact that the device is reaching end-of-life (EoL) and has been replaced by newer models.

Belkin Wemo Smart Plugs
"It appears that this vulnerability could be triggered via the Cloud interface (meaning, without a direct connection to the device)," the researchers cautioned.

In the absence of a fix, users of Wemo Mini Smart Plug V2 are recommended to avoid exposing them directly to the internet and ensure that appropriate segmentation measures are implemented if they have been deployed in sensitive networks.

"This is what happens when devices are shipped without any on-device protection. If you only rely on responsive security patching, as most device manufacturers do today, two things are certain: you will always be one step behind the attacker, and one day the patches will stop coming," said Igal Zeifman, vice president of marketing for Sternum.