TropOS 4th Gen vulnerabilities

The “Diagnostics Tools” page of the TropOS 4th Gen web configuration utility does not properly validate user-controlled input, allowing an authenticated high-privileged user to inject commands into the device command shell. Injected commands can be used to execute SUID applications and gain root access.

On TropOS 4th Gen devices, an authenticated user able to run user-level shell commands can gain access via SSH to an unrestricted root shell. This is possible through abuse of a set of scripts and executables that allow certain commands to be run as root from an unprivileged context.

A command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.