Lucene search

MitreCVE-2019-16340

HistoryNov 21, 2019 - 3:15 p.m.

CVE-2019-16340

2019-11-2115:15:13

CWE-425

mitre

web.nvd.nist.gov

cve-2019-16340

belkin

linksys

velop

remote attackers

recovery key

sysinfo_json.cgi uri

security vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.009

Percentile

83.4%

JSON

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.

Affected configurations

Nvd

Node

linksysvelop_whw0303_firmwareMatch1.1.8.192419

AND

linksysvelop_whw0303Match-

Node

linksysvelop_whw0302_firmwareMatch1.1.8.192419

AND

linksysvelop_whw0302Match-

Node

linksysvelop_whw0301_firmwareMatch1.1.8.192419

AND

linksysvelop_whw0301Match-

VendorProductVersionCPE
linksysvelop_whw0303_firmware1.1.8.192419cpe:2.3:o:linksys:velop_whw0303_firmware:1.1.8.192419:*:*:*:*:*:*:*
linksysvelop_whw0303-cpe:2.3:h:linksys:velop_whw0303:-:*:*:*:*:*:*:*
linksysvelop_whw0302_firmware1.1.8.192419cpe:2.3:o:linksys:velop_whw0302_firmware:1.1.8.192419:*:*:*:*:*:*:*
linksysvelop_whw0302-cpe:2.3:h:linksys:velop_whw0302:-:*:*:*:*:*:*:*
linksysvelop_whw0301_firmware1.1.8.192419cpe:2.3:o:linksys:velop_whw0301_firmware:1.1.8.192419:*:*:*:*:*:*:*
linksysvelop_whw0301-cpe:2.3:h:linksys:velop_whw0301:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linksys	velop_whw0303_firmware	1.1.8.192419	cpe:2.3:o:linksys:velop_whw0303_firmware:1.1.8.192419:::::::*
linksys	velop_whw0303	-	cpe:2.3:h:linksys:velop_whw0303:-:::::::*
linksys	velop_whw0302_firmware	1.1.8.192419	cpe:2.3:o:linksys:velop_whw0302_firmware:1.1.8.192419:::::::*
linksys	velop_whw0302	-	cpe:2.3:h:linksys:velop_whw0302:-:::::::*
linksys	velop_whw0301_firmware	1.1.8.192419	cpe:2.3:o:linksys:velop_whw0301_firmware:1.1.8.192419:::::::*
linksys	velop_whw0301	-	cpe:2.3:h:linksys:velop_whw0301:-:::::::*

References

s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt

puzzor.github.io/Linksys-Velop-Authentication-bypass

www.linksys.com/us/support-article?articleNum=207568

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.009

Percentile

83.4%

JSON

Related for CVE-2019-16340