Lucene search

TenableCVE-2019-3986

HistoryDec 11, 2019 - 11:15 p.m.

CVE-2019-3986

2019-12-1123:15:11

CWE-78

tenable

web.nvd.nist.gov

blink xt2

sync module

firmware

remote command execution

input sanitization

cve-2019-3986

nvd

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter.

Affected configurations

Nvd

Node

amazonblink_xt2_sync_module_firmwareRange<2.13.11

AND

amazonblink_xt2_sync_moduleMatch-

VendorProductVersionCPE
amazonblink_xt2_sync_module_firmware*cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*
amazonblink_xt2_sync_module-cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
amazon	blink_xt2_sync_module_firmware	*	cpe:2.3:o:amazon:blink_xt2_sync_module_firmware::::::::
amazon	blink_xt2_sync_module	-	cpe:2.3:h:amazon:blink_xt2_sync_module:-:::::::*

CNA Affected

[
  {
    "product": "Amazon's Blink XT2 Sync Module",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All firmware versions prior to version 2.13.11"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2019-51

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

Related for CVE-2019-3986