← Back to CVEs

CVE-2019-15310

CRITICAL

9.8

Description

An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate, including S3 buckets containing device firmware. When combined with an OS command injection vulnerability within the XML Parsing logic of the firmware update process, an attacker would be able to gain code execution on any device that attempted to update. Note that by default all devices tested had automatic updates enabled.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/1/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

linkplay:linkplay

Weaknesses (CWE)

CWE-78CWE-639

References

https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/(cve@mitre.org)

https://labs.mwrinfosecurity.com/advisories/(cve@mitre.org)

https://linkplay.com/featured-products/(cve@mitre.org)

https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/(af854a3a-2127-422b-91ae-364da2661108)

https://labs.mwrinfosecurity.com/advisories/(af854a3a-2127-422b-91ae-364da2661108)

https://linkplay.com/featured-products/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.