A publicly exposed webshell on a webserver of shenzhen sanjitongchuang electronic co. LTD allowed an attacker to execute arbitrary operating system commands (RCE) and access to internal files

A backdoor, more precisely a webshell, was discovered on a web server belonging to Shenzhen Sanjitongchuang Electronic Co. LTD, the manufacturer of the SeTracker Mobile App and API, which is used by children's smartwatches and other tracking devices from various manufacturers. The discovered backdoor provided the ability to execute arbitrary commands (remote code execution, RCE) and access internal files. Since the vendor has not responded, it remains unclear whether other vulnerabilities were exploited by an attacker to install the backdoor, who installed it, and whether customer data was exfiltrated.

In the past, other severe vulnerabilities affecting this manufacturer have been reported, for example by the Norwegian Consumer Council:
https://www.forbrukerradet.no/side/significant-security-flaws-in-smartwatches-for-children/

In accordance with NTC Vulnerability Disclosure Policy, no technical details about this vulnerability will be publicly disclosed. Further details may be provided on a case by case basis.

Please use the contact form and provide an explanation for your request.