Lucene search

MitreCVE-2019-16737

HistoryDec 13, 2019 - 9:15 p.m.

CVE-2019-16737

2019-12-1321:15:17

CWE-78

mitre

web.nvd.nist.gov

cve-2019-16737

petwant pf-103

petalk ai

remote code execution

root user access

firmware vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.069

Percentile

93.9%

JSON

The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.

Affected configurations

Nvd

Node

skymeepetalk_ai_firmwareMatch3.2.2.30

AND

skymeepetalk_aiMatch-

Node

petwantpf-103_firmwareMatch4.22.2.42

AND

petwantpf-103Match-

VendorProductVersionCPE
skymeepetalk_ai_firmware3.2.2.30cpe:2.3:o:skymee:petalk_ai_firmware:3.2.2.30:*:*:*:*:*:*:*
skymeepetalk_ai-cpe:2.3:h:skymee:petalk_ai:-:*:*:*:*:*:*:*
petwantpf-103_firmware4.22.2.42cpe:2.3:o:petwant:pf-103_firmware:4.22.2.42:*:*:*:*:*:*:*
petwantpf-103-cpe:2.3:h:petwant:pf-103:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
skymee	petalk_ai_firmware	3.2.2.30	cpe:2.3:o:skymee:petalk_ai_firmware:3.2.2.30:::::::*
skymee	petalk_ai	-	cpe:2.3:h:skymee:petalk_ai:-:::::::*
petwant	pf-103_firmware	4.22.2.42	cpe:2.3:o:petwant:pf-103_firmware:4.22.2.42:::::::*
petwant	pf-103	-	cpe:2.3:h:petwant:pf-103:-:::::::*

References

blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.069

Percentile

93.9%

JSON

Related for CVE-2019-16737