CVE-2019-15312

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS rebinding. Combined with one of the many /httpapi.asp endpoint command-execution security issues, the DNS rebinding attack could allow an...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...

CVE-2019-15311

CVE-2019-15311 affects Zolo Halo devices via the Linkplay firmware. The vulnerability resides in the GoAhead web server running on port 80, with the /httpapi.asp endpoint exposing multiple command-execution flaws that enable LAN remote code execution. Multiple connected sources corroborate a GoAh...

CVE-2019-15310

An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate, including S3 buckets containing device firmware. When...

CVE-2019-15310

CVE-2019-15310 affects Linkplay firmware. The issue enables WAN remote code execution without user interaction, enabling an attacker to retrieve the firmware AWS credentials and gain full control over Linkplay’s AWS estate, including S3 buckets containing device firmware. When combined with an OS...