CVE-2019-3914 Command injection in Fios Quantum Gateway (G1100)
Authenticated attackers can execute arbitrary commands on Verizon Fios Quantum Gateways via crafted hostnames in access control rules.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3914?
CVE-2019-3914 is a high-severity command injection vulnerability in Verizon Fios Quantum Gateway (G1100), published on 11 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated attacker to execute arbitrary commands on the target device by adding an access control rule for a network object with a crafted hostname.
Weakness: CWE-78
Which versions are affected by CVE-2019-3914?
It affects 1 product.
Products include Verizon Fios Quantum Gateway G1100 Firmware.
How do I fix CVE-2019-3914?
No fix has been published for CVE-2019-3914 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-3914 being exploited?
There is no known exploitation of CVE-2019-3914 in the wild and no public exploit code.
Other vulnerabilities in Verizon Fios Quantum Gateway (G1100)
Sources
Also known as GHSA-742j-rfqh-7886.