CVE-2019-15310 Command injection in n/a
Attackers can execute arbitrary code on IoT devices via OS command injection in firmware updates, potentially compromising the entire AWS infrastructure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15310?
CVE-2019-15310 is a critical command injection vulnerability in n/a, published on 1 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate, including S3 buckets containing device firmware. When combined with an OS command injection vulnerability within the XML Parsing logic of the firmware update process, an attacker would be able to gain code execution on any device that attempted to update. Note that by default all devices tested had automatic updates enabled.
Which versions are affected by CVE-2019-15310?
It affects 1 product.
Products include Linkplay Linkplay.
How do I fix CVE-2019-15310?
No fix has been published for CVE-2019-15310 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-15310 being exploited?
There is no known exploitation of CVE-2019-15310 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xmvm-x7m2-gg4f.