CVE-2019-3983 Hardcoded credentials in Amazon's Blink XT2 Sync Module
Remote attackers can execute arbitrary code on Blink XT2 Sync Modules due to insufficient UART protections, requiring a firmware upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3983?
CVE-2019-3983 is a medium-severity vulnerability in Amazon's Blink XT2 Sync Module, published on 11 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protections.
Weakness: CWE-798
Which versions are affected by CVE-2019-3983?
It affects 1 product.
Products include Amazon Blink Xt2 Sync Module Firmware.
How do I fix CVE-2019-3983?
No fix has been published for CVE-2019-3983 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3983 being exploited?
There is no known exploitation of CVE-2019-3983 in the wild and no public exploit code.
Other vulnerabilities in Amazon's Blink XT2 Sync Module
- CVE-2019-3984 Command injection in Blink XT2 Sync Module firmware
- CVE-2019-3989 Command injection in Amazon's Blink XT2 Sync Module
- CVE-2019-3985 Command injection in Amazon's Blink XT2 Sync Module
- CVE-2019-3986 Command injection in Amazon's Blink XT2 Sync Module
- CVE-2019-3987 Command injection in Amazon's Blink XT2 Sync Module
Sources
Also known as GHSA-qc4p-vcpx-mm6g.