CVE-2018-19524 Memory corruption in n/a
Remote attackers can trigger a segmentation fault or execute arbitrary code via a long password in the Web_passwd function on Skyworth IPTV terminals.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-19524?
CVE-2018-19524 is a critical memory corruption vulnerability in n/a, published on 17 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. A long password to the Web_passwd function allows remote attackers to cause a denial of service (segmentation fault) or achieve unauthenticated remote code execution because of control of registers S0 through S4 and T4 through T7.
Weakness: CWE-20
Which versions are affected by CVE-2018-19524?
It affects 3 products.
Products include Skyworthdigital Dt721-Cb Firmware, Skyworthdigital Dt740 Firmware, Skyworthdigital Dt741-Cb Firmware.
How do I fix CVE-2018-19524?
No fix has been published for CVE-2018-19524 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-19524 being exploited?
There is no known exploitation of CVE-2018-19524 in the wild and no public exploit code.
Public exploit code: 2 Exploit-DB entries.
Sources
Also known as GHSA-jc55-53w2-vrjv.