Lucene search

TenableCVE-2019-3984

HistoryDec 31, 2019 - 6:15 p.m.

CVE-2019-3984

2019-12-3118:15:11

CWE-78

tenable

web.nvd.nist.gov

cve-2019-3984

blink xt2

sync module

firmware

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.011

Percentile

84.8%

JSON

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.

Affected configurations

Nvd

Node

amazonblink_xt2_sync_module_firmwareRange<2.3.11

AND

amazonblink_xt2_sync_moduleMatch-

VendorProductVersionCPE
amazonblink_xt2_sync_module_firmware*cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*
amazonblink_xt2_sync_module-cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
amazon	blink_xt2_sync_module_firmware	*	cpe:2.3:o:amazon:blink_xt2_sync_module_firmware::::::::
amazon	blink_xt2_sync_module	-	cpe:2.3:h:amazon:blink_xt2_sync_module:-:::::::*

CNA Affected

[
  {
    "product": "Blink XT2 Sync Module firmware",
    "vendor": "Amazon",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 2.13.11"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2019-51

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.011

Percentile

84.8%

JSON

Related for CVE-2019-3984