Watch out, hackers can take over your Cosori Smart Air Fryer

Watch out, hackers could breach into your house by exploiting two remote code execution (RCE) vulnerabilities in the Cosori Smart Air Fryer.

Security experts from Cisco Talos have found two remote code execution (RCE) vulnerabilities in the Cosori Smart Air Fryer. The Cosori Smart Air Fryer is an appliance with smart capabilities that cooks food with a variety of methods and settings. Users can control the device via Wi-Fi, they can start and stop cooking, look up recipe guides and monitor cooking status.

The flaws could be exploited by threat actors to take over the devices and perform a broad range of malicious actions, some of the issues could be only exploited by attackers with physical access to the air fryer.

“TALOS-2020-1216 (CVE-2020-28592) and TALOS-2020-1217 (CVE-2020-28593) are remote code execution vulnerabilities that could allow an attacker to remotely inject code into the device. This could hypothetically allow an adversary to change temperatures, cooking times and settings on the air fryer, or start it without the user’s knowledge. The adversary must have physical access to the air fryer for some of these vulnerabilities to work.” reads the post published by Talos.

The CVE-2020-28592 and CVE-2020-28593 flaws affect the Cosori Smart 5.8-Quart Air Fryer CS158-AF (v.1.1.0). The CVE-2020-28592 is a heap-based buffer overflow vulnerability that resides in the configuration server functionality of the smart fryer. The vulnerability could be exploited by sending a packet containing a specially crafted JSON object to the device.

The CVE-2020-28593 is an unauthenticated backdoor that resides in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. The vulnerability could be exploited by sending a packet containing a specially crafted JSON object to the device.

Cisco Talos experts disclosed these vulnerabilities despite they have yet to be fixed by the vendor because Cosori failed to address them in a 90-day period of Cisco’s vulnerability disclosure policy.

Talos team released SNORT rule “56729” that allow to detect exploitation attempts against these vulnerabilities. 

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, smart air fryer)

[adrotate banner=”5″]

[adrotate banner=”13″]