CVE-2018-15723: Command Injection
Published Dec 20, 2018
·Updated
The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).
Affected Software
2 affected components
Logitech Harmony Hub Firmware<4.15.206
Logitech Harmony Hub
Event History
Dec 20, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-15723?
CVE-2018-15723 is considered a high severity vulnerability due to potential remote code execution.
2
How do I fix CVE-2018-15723?
To fix CVE-2018-15723, update your Logitech Harmony Hub firmware to version 4.15.206 or later.
3
What types of attacks can exploit CVE-2018-15723?
CVE-2018-15723 can be exploited via crafted HTTP requests to execute unauthorized application commands.
4
Who is affected by CVE-2018-15723?
Users of Logitech Harmony Hub firmware versions prior to 4.15.206 are affected by CVE-2018-15723.
5
Is authentication required to exploit CVE-2018-15723?
No, CVE-2018-15723 can be exploited by unauthenticated remote attackers.