CVE-2019-13398: OS Command Injection
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi (save parameter) and cgi-bin/ddns.cgi.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13398?
CVE-2019-13398 has a high severity rating due to its potential for remote command execution.
How do I fix CVE-2019-13398?
To fix CVE-2019-13398, update the Dynacolor FCM-MB40 devices to the latest firmware version that addresses this vulnerability.
What types of attacks does CVE-2019-13398 enable?
CVE-2019-13398 enables remote attackers to execute arbitrary commands on affected devices via crafted parameters.
Which devices are impacted by CVE-2019-13398?
CVE-2019-13398 specifically impacts Dynacolor FCM-MB40 devices running firmware version 1.2.0.0.
What scripts are vulnerable according to CVE-2019-13398?
According to CVE-2019-13398, the vulnerable scripts include cgi-bin/camctrl_save_profile.cgi and cgi-bin/ddns.cgi.