CVE-2019-3988 - Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter

Back Back to CVE browser

HIGH

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter

Published Dec 11, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.66%

Description

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter.

Affected products

Vendor n/a Product Amazon's Blink XT2 Sync Module Default
n/a
- Version
  All firmware versions prior to version 2.13.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Amazon's Blink XT2 Sync Module

n/a

Version	Status	Constraints
All firmware versions prior to version 2.13.11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13595
Advisory
https://www.tenable.com/security/research/tra-2019-51
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13595		Advisory
https://www.tenable.com/security/research/tra-2019-51		x_refsource_CONFIRMExploitThird Party Advisory