Attack Chain

1. Attacker gains initial local access (shell) to the satellite terminal.
2. Attacker interacts with the unauthenticated Redis IPC bus via the pre-installed redis-cli tool.
3. Attacker sets the INSTALL_DIR Redis key to a path controlled by the attacker (e.g., /tmp/pkg).
4. Attacker creates a malicious shell script (e.g., /tmp/escalate.sh) to perform unauthorized modifications such as changing user UIDs in /etc/passwd.
5. Attacker sets the INSTALL_SCRIPT Redis key to the path of the malicious script.
6. Attacker triggers the installation process by setting the INSTALL_START key to 1.
7. The sysmngr service executes the attacker-provided script with root privileges.
8. Attacker gains persistent root access on the terminal.

Impact

Successful exploitation allows any unprivileged user, including restricted field-technician accounts, to escalate privileges to root. This grants full control over the terminal, enabling firmware modification, traffic interception, credential harvesting, satellite link manipulation, and lateral movement to other network-connected infrastructure.

Recommendation

1. Upgrade all affected iQ-Series, 3315-Series, and 9-Series terminals to firmware version 4.5.3.0 or newer immediately.
2. For terminals that cannot be upgraded, implement the following mitigations:

• Apply a strong requirepass password in /etc/idirect/redis.conf and update all system processes to authenticate.
• Restrict Redis network access by binding it to 127.0.0.1.
• Implement host-based firewall rules (e.g., iptables) to block unauthorized access to the Redis port (6379) from external interfaces.
• Proactively audit current user accounts and /etc/passwd for unauthorized UID modifications.