ReQuest Serious Play F3 Media Server 7.0.3 Remote DoS Vulnerability

Vulnerability Key Information Title: ReQuest Serious Play F3 Media Server 7.0.3 Remote Denial of Service Advisory ID: ZSL-2020-5601 Type: Local/Remote Impact: DoS (Denial of Service) Risk: 3/5 Release Date: 2020-10-18 Summary F3 integrates all the features of ReQuest's multi-room Serious Play server into a compact system. By adding unlimited NAS devices, F3 can easily manage an entire household's media collection. Description The device can be shut down or rebooted by an unauthenticated attacker by sending an HTTP GET request. Vendor ReQuest Serious Play LLC - http://www.request.com Affected Versions 7.0.3.4968 (Pro) 7.0.2.4954 6.5.2.4954 6.4.2.4681 6.3.2.4203 2.0.1.823 Test Environment ReQuest Serious Play® OS v7.0.1 ReQuest Serious Play® OS v6.0.0 Debian GNU/Linux 5.0 Linux 3.2.0-4-686-pae Linux 2.6.36-request+lenny.5 Apache/2.2.22 Apache/2.2.9 PHP/5.4.45 PHP/5.2.6-1 Vendor Status [2020-08-01] Vulnerability discovered. [2020-08-16] Vendor contacted. [2020-10-17] Vendor unresponsive. [2020-10-18] Public security advisory released. Exploit request_dos.txt Acknowledgments Vulnerability discovered by Gjoko Krstic - References 1. https://packetstormsecurity.com/files/159602/ 2. https://cxsecurity.com/issue/WLB-2020100122 3. https://exchange.xforce.ibmcloud.com/vulnerabilities/190031 4. https://www.exploit-db.com/exploits/48951 Update Log [2020-10-18] - Initial release [2020-10-20] - Added references [1] and [2] [2020-10-26] - Added references [3] and [4]

Goal Reached Thanks to every supporter — we hit 100%!

ReQuest Serious Play F3 Media Server 7.0.3 Remote DoS Vulnerability