ENLBufferPwn (CVE-2022-47949) is a vulnerability in the network code used in many first party Nintendo games since the 3DS. Combined with the right techniques, it allows remote code execution in the victim's console by just having an online game session with the attacker. The vulnerability was discovered by multiple people independently during 2021 and reported to Nintendo during 2021/2022. The severity of the vulnerability has been calculated as 9.8/10 (Critical) by the CVSS 3.1 calculator.

Combined with other OS vulnerabilities, full remote console takeover can be achieved. This has been demonstrated in the case of Mario Kart 7, where a payload is sent to launch SafeB9SInstaller. However, it is theoretically possible to do other malicious activities, such as stealing account/credit card information or taking unauthorized audio/video recordings using the console built-in mic/cameras.

Here is a list of games that are known to have had the vulnerability at some point (all the Switch and 3DS games listed have received updates that patch the vulnerability, so they are no longer affected):

• Mario Kart 7 (fixed in v1.2)
• Mario Kart 8 (still not fixed)
• Mario Kart 8 Deluxe (fixed in v2.1.0)
• Animal Crossing: New Horizons (fixed in v2.0.6)
• ARMS (fixed in v5.4.1)
• Splatoon (still not fixed)
• Splatoon 2 (fixed in v5.5.1)
• Splatoon 3 (fixed in late 2022, exact version unknown)
• Super Mario Maker 2 (fixed in v3.0.2)
• Nintendo Switch Sports (fixed in late 2022, exact version unknown)
• Probably more...

Below you can find proof of concept videos showcasing the vulnerability in Mario Kart 7 and Mario Kart 8.





A full report of the vulnerability can be found in the following GitHub repository.
Full vulnerability report (GitHub)

 

[kb7cxWMSrPwL]

Could you imagine a self replicating worm that pollutes legit users with false install and error logs on the switch?
Potentially 10s of millions of users would risk false bans to the point Nintendo would probably have to stop banning even hacked consoles due to sheer volume of complaints

 

[regnad]

Boioioing!

 

[Guacaholey]

Lmao, not only is their online services complete ass, now this too! Has this crap like ever happened on them Sony consoles or Microsoft? Genuinely asking because I'm not sure, heh.
At least it seems they've been stepping up their game to fix this shit, but damn, just... Craptendo and anything regarding the internet are basically opposites of each other, heh.

Those companies have had servers hacked, and Steam had a huge exploit a few years back where hackers could use other user's saved credit cards for purchases.

 

[Halbour]

Without other exploits it's useless

booooooooooo lol

 

[Mayo1990]

Nooo they may have stolen my pingas and sexy pictures I took in my 3DS

May as well post them here:

Spoiler

Spoiler

 

[FAST6191]

Would have liked to see a proper viral (in the classical computing sense) hack where one hack proceeds to another and thus everybody ends up on custom firmwares.

 

[Halbour]

Would have liked to see a proper viral (in the classical computing sense) hack where one hack proceeds to another and thus everybody ends up on custom firmwares.

Would love....

 

[Dax_Fame]

I wonder how far up the line it can go on the Switch.

I would also like to see what else possible... Remote console bricking? Now that's critical

 

[ertaboy356b]

Nintendo really hates the Wii U, they don't release patches for it

 

[Guacaholey]

I would also like to see what else possible... Remote console bricking? Now that's critical

Gateway 3DS already did that.

 

[SylverReZ]

Gateway 3DS already did that.

Indeed.

 

[NinStar]

Since no one seems to have posted this here yet:

 

[N7Kopper]

Gateway 3DS already did that.

That was local, not remote. You installed Gateway's shitty hacks and used their shitty card firmwares. Remote would be me bricking your 3DS from halfway around the world because you had the misfortune to be matchmade with me.

 

[Brandoman142]

that's an impressively vague name for a service, no wonder i've never heard of it... and can't find any results for it

Main page is: https://floatcard.com/ unfortunately it's designed for corporate rather than individual use.

 

[wolf-snake]

Lmao, not only is their online services complete ass, now this too! Has this crap like ever happened on them Sony consoles or Microsoft? Genuinely asking because I'm not sure, heh.
At least it seems they've been stepping up their game to fix this shit, but damn, just... Craptendo and anything regarding the internet are basically opposites of each other, heh.

This is how you can tell someone's like 11... Or lives under a rock on the seafloor of the Mariana Trench.

 

[Sowden]

Well its a black eye for Nintendo to be ignoring us Wii U users, but I'm thankful to the kind people at Pretendo for creating a Aroma plugin to help protect us. But I'm wondering, has anyone tried testing the first Super Mario Maker, or maybe Dr Luigi on the Wii U? Or does anyone here have the capability to test?

 

[Ducolamia]

Would be nice if this would be a breakthrough for CFW. I really want to soft-mod my OLED, but time will tell.

That being said, don't store credit card info on game systems ever. Lol

 

[impeeza]

Spoiler

I wonder if we could use this to launch homebrew on the OLED, without using any hardware mod...

No can do because on switch on newer firmwares (since 4.0.1) there is no way to get kernel privilege from userland which is rhe security context of the games

 

[xoxo25]

i try the sendfile.py i dont understand this error :
Opening Gambit.rtx
2023-02-05 21:51:59 : /!\ An error occured. /!\
2023-02-05 21:51:59 : Moving to: ftp://storage_mlc/usr/title/0005000e/code
2023-02-05 21:51:59 : Couldn't retrieve file list
2023-02-05 21:51:59 : Sending file
2023-02-05 21:51:59 : /!\ An error occured. /!\

 

[PabloMK7]

i try the sendfile.py i dont understand this error :
Opening Gambit.rtx
2023-02-05 21:51:59 : /!\ An error occured. /!\
2023-02-05 21:51:59 : Moving to: ftp://storage_mlc/usr/title/0005000e/code
2023-02-05 21:51:59 : Couldn't retrieve file list
2023-02-05 21:51:59 : Sending file
2023-02-05 21:51:59 : /!\ An error occured. /!\

`sendfile.py` is a python script for sending files to the 3ds SD. In this case, it is used to help testing the 3GX plugin during its development. It's not related to the exploit in any way. x)