LCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again
summary
Series of zero days target CDP and LLDP parsing code across vendors rather than a protocol-level claim the work finds nearly 70 affected device models from about 30 vendors and uncovers roughly 50 distinct bugs. Analysis uses static firmware analysis and targeted emulation plus firmware unpacking to build malformed CDP/LLDP frames that trigger stack overwrite and heap overflow patterns. Multiple vulnerabilities allow remote code execution on real products (Cisco IP phone, IOS XR router, IP camera, small business switch) and most issues are confirmed reported and patched.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:29What is LCDPwn
- 4:25CDP and LLDP protocols
- 9:01CDP vulnerabilities
- 17:29LLDP research method
- 21:44LLDP components and flaws
- 31:27LLDP vulnerabilities
- 33:13Summary
related talks
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
54mThe Kitchen's Finally Burned Down: DLP Security Bakeoff
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
54mStay Out of the Kitchen: A DLP Security Bake-Off
50mPwnie Awards 2016