Command injection

The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication...

PT-2019-12940

Name of the Vulnerable Software and Affected Versions Belkin Wemo Enabled Crock-Pot affected versions not specified Description The issue concerns command injection in the Wemo UPnP API. Specifically, it affects the SmartDevURL argument to the SetSmartDevInfo action. An attacker can exploit this ...