1. Reporting information

Team name : Team Brrester

2. Overview of Vulnerabilities

• Vulnerability title: Command Injection
• Date of discovery: 2025.07.10
• Discovery Location (URL or System Path) : Input parameters of setddns_pip_system() in netserver
• Vulnerability Type (CWE ID): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Vulnerability Description: It is passed to pip_system(), which acts as a function of the user's input system() and allows instruction to be inserted due to incomplete shell metacharacter filtering.

3. Details

• Impacted Products/Services: Smart 2K+ Wired WiFi Video Doorbell with Chime d340w
• Product version: firmware v3.0.0.4662_2503122283
• Vulnerable Components:

undefined4 setddns_config(int *param_1)

{
  char *pcVar1;
  size_t sVar2;
  int iVar3;
  char acStack_9a0 [128];
  char local_920 [256];
  char acStack_820 [1024];
  undefined1 auStack_420 [1028];
  
  memset(local_920,0,0x100);
  memset(acStack_9a0,0,0x80);
  memset(acStack_820,0,0x400);
  memset(auStack_420,0,0x400);
  if (param_1 == (int *)0x0) {
    return 0xffffffff;
  }
  iVar3 = *param_1;
  if (iVar3 == 3) {
    if ((((char)param_1[0x21] == '\\0') && ((char)param_1[0x41] == '\\0')) &&
       ((char)param_1[0x61] == '\\0')) {
      return 0;
    }
    strcpy(acStack_9a0,"members.3322.org");
    pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
    pcVar1 = "ln -s /mnt/tmp/ddns/ddnsrun.3322 /mnt/tmp/ddns/ddnsrun";
LAB_000cbba4:
    pip_system(pcVar1);
    pcVar1 = "/mnt/tmp/ddns/ddns-config %s %s %s %s %d %s";
  }
  else {
    if (iVar3 != 0) {
      if (iVar3 != 1) {
        if (iVar3 == 4) {
          if ((((char)param_1[0x21] == '\\0') && ((char)param_1[0x41] == '\\0')) &&
             ((char)param_1[0x61] == '\\0')) {
            return 0;
          }
          snprintf(acStack_820,0x3ff,"%s:%s",param_1 + 0x41,param_1 + 0x61);
          sVar2 = strlen(acStack_820);
          iVar3 = FUN_000cb82c(acStack_820,sVar2,auStack_420,0x400);
          if (iVar3 < 0) {
            return 0xffffffff;
          }
          strcpy(acStack_9a0,"dynupdate.no-ip.com");
          if ((char)param_1[1] == '\\0') {
            strcpy((char *)(param_1 + 1),"dynupdate.no-ip.com");
          }
          pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
          pip_system("ln -s /mnt/tmp/ddns/ddnsrun.noip /mnt/tmp/ddns/ddnsrun");
          snprintf(local_920,0x100,"/mnt/tmp/ddns/ddns-config %s %s %s %s %d %s %s ",param_1 + 0x21,
                   param_1 + 0x41,param_1 + 0x61,acStack_9a0,1,param_1 + 1,auStack_420);
        }
        else {
          if (iVar3 != 2) {
            return 0xffffffff;
          }
          strcpy(acStack_9a0,"www.perfecteyes.com");
          pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
          pip_system("ln -s /mnt/tmp/ddns/ddnsrun.perfecteyes /mnt/tmp/ddns/ddnsrun");
        }
        goto LAB_000cbc90;
      }
      if ((((char)param_1[0x21] == '\\0') && ((char)param_1[0x41] == '\\0')) &&
         ((char)param_1[0x61] == '\\0')) {
        return 0;
      }
      strcpy(acStack_9a0,"members.dyndns.org");
      pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
      pcVar1 = "ln -s /mnt/tmp/ddns/ddnsrun.dyndns /mnt/tmp/ddns/ddnsrun";
      goto LAB_000cbba4;
    }
    if ((((char)param_1[0x21] == '\\0') && ((char)param_1[0x41] == '\\0')) &&
       ((char)param_1[0x61] == '\\0')) {
      return 0;
    }
    snprintf(acStack_820,0x400,"%s:%s",param_1 + 0x41,param_1 + 0x61);
    sVar2 = strlen(acStack_820);
    iVar3 = FUN_000cb82c(acStack_820,sVar2,auStack_420,0x400);
    if (iVar3 < 0) {
      return 0xffffffff;
    }
    strcpy(acStack_9a0,"mydvr.swanndvr.com");
    pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
    pip_system("ln -s /mnt/tmp/ddns/ddnsrun.swann /mnt/tmp/ddns/ddnsrun");
    pcVar1 = "/mnt/tmp/ddns/ddns-config %s.swanndvr.net %s %s %s %d %s";
  }
  snprintf(local_920,0x100,pcVar1,param_1 + 0x21,param_1 + 0x41,param_1 + 0x61,acStack_9a0,1,
           param_1 + 1);
LAB_000cbc90:
  if (local_920[0] != '\\0') {
    pip_system(local_920);
  }
  pip_system("/mnt/tmp/ddns/ddns-start &");
  return 0;
}

look at this code

pip_system("rm /mnt/tmp/ddns/ddnsrun -f");
    pip_system("ln -s /mnt/tmp/ddns/ddnsrun.swann /mnt/tmp/ddns/ddnsrun");
    pcVar1 = "/mnt/tmp/ddns/ddns-config %s.swanndvr.net %s %s %s %d %s";
  }
  snprintf(local_920,0x100,pcVar1,param_1 + 0x21,param_1 + 0x41,param_1 + 0x61,acStack_9a0,1,
           param_1 + 1);
LAB_000cbc90:
  if (local_920[0] != '\\0') {
    pip_system(local_920);
  }

When you set up ddnsrun, if local_920[0] is not null, run local_920 as pip_system(), which is the same function as system().

The SetDdns command is

[
	{"cmd":"SetDdns",
	"action":0,
	"param":
		{"Ddns":
			{
				"domain":"asdf",
				"enable":1,
				"password":"***********",
				"type":"Dyndns",
				"userName":"exaexam"
				}
			}
		}
	]

To send, domain, enable, password, type, and userName are respectively