CVE-2019-3984 - Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet

Back Back to CVE browser

CRITICAL

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet

Published Dec 31, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 3.77%

Description

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.

Affected products

Vendor Amazon Product Blink XT2 Sync Module firmware Default
n/a
- Version
  prior to 2.13.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Amazon

Blink XT2 Sync Module firmware

n/a

Version	Status	Constraints
prior to 2.13.11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13591
Advisory
https://www.tenable.com/security/research/tra-2019-51
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13591		Advisory
https://www.tenable.com/security/research/tra-2019-51		x_refsource_CONFIRMExploitThird Party Advisory