# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 7 Evaluation
### Effectiveness
#### 7.3.2 Zero-Day Vulnerabilities Detection  
After testing the vulnerable devices, the effectiveness of this work was initially explained. Next, we further demonstrate the effectiveness of the work. We chose different embedded devices than those that have been used to test brands. That is, various equipment was selected from the D-Link manufacturer for testing. Finally, we found four command injection vulnerabilities and three authentication bypass vulnerabilities in the D-Link series routers. It is worth mentioning that when testing the Netgear DGN2200 to cover existing vulnerabilities, a new authentication bypass vulnerability was discovered by EWVHunter. Our EWVHunter found seven zero-day vulnerabilities in five devices, five of which have applied for CVE numbers, and two were waiting for CVE official approval due to time. The vulnerability information found by EWVHunter is shown in Table 6.  
The data transmitted by D-Link DIR-850L is a XML type of POST. The input point on the web front-end is the NTP Server option. After user input, this program did not sanitize unsafe user-supplied data and passed it to a system shell, resulting in command injection vulnerability. D-Link DIR-850L's stateful network protocol belongs to the category of relevancy in context. We gave it a detailed vulnerability analysis in Section 7.2. The data transmitted by D-Link DIR-846 is a JSON type of POST. The first input point of the first vulnerability in the web front-end was where the wireless network name was set in \"Wireless.html\". As the user's input was not filtered, the page handle directly executed the transmitted string, which led to the appearance of a command injection vulnerability. As developers reused this part of the processing code, there were two similar vulnerabilities on the page \"Guestwireless.html\" and \"MobileWireless.html\". As we considered this situation, we designed a \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Device** & **Vul-ID** & **Vulnerability** & **Remotely Exploitable** & **CVE-ID** \\ \hline D-Link DIR-850L & 1 & Command injection & True & CVE-2019-17508 \\ \hline \multirow{3}{*}{D-Link DIR-846} & 2 & Command injection & True & CVE-2019-17509 \\ \cline{2-5}  & 3 & Command injection & True & unassigned \\ \cline{2-5}  & 4 & Command injection & True & unassigned \\ \hline D-Link DIR-412 & 5 & Authentication bypass & True & CVE-2019-17511 \\ \hline D-Link DAP-1320 & 6 & Authentication bypass & True & CVE-2019-17505 \\ \hline Netgear DGN2200 & 7 & Authentication bypass & True & CVE-2019-17373 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Summary of discovered vulnerabilities. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Device** & **Vul-ID** & **Vulnerability** & **Remotely Exploitable** & **CVE-ID** \\ \hline Netgear DGN2200 & 1 & Command injection & True & CVE-2017-6077 \\ \hline \multirow{3}{*}{Tenda AC9} & 2 & Command injection & True & CVE-2019-5071 \\ \cline{2-5}  & 3 & Command injection & True & CVE-2019-5072 \\ \hline Netgear DGN1000 & 4 & Authentication bypass & True & N-day \\ \hline Trendnet TEW-733 GR & 5 & Authentication bypass & True & CVE-2018-7034 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary of public vulnerabilities. fuzz scheduling, that is, the seeds that triggered the vulnerability would have the highest priority in the same fuzzing process. So EWVHunter could quickly find similar security flaws in the same device. The D-Link DIR-846 and the D-Link DIR-850L used the same vulnerability detection strategy. The D-Link DIR-412 device's authentication bypass vulnerability was that the log information on the device could be seen when directly accessing the \"log_get.php\" page. The D-Link DAP-1320 device's authentication bypass vulnerability existed in the \"uplink_info.xml\" page, which could directly access and obtain the wireless authentication information Wi-Fi SSID and password without authentication.