CVE-2019-3950: Critical severity arlo vmb3010 firmware vulnerability
Arlo Basestation firmware 1.12.0.127940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3950?
CVE-2019-3950 has been classified as a high severity vulnerability due to the hardcoded credentials that allow root access to the device.
How do I fix CVE-2019-3950?
To mitigate CVE-2019-3950, upgrade the Arlo Firmware to version 1.12.2.3_2762 or later.
Which Arlo devices are affected by CVE-2019-3950?
CVE-2019-3950 affects Arlo devices running firmware versions 1.12.0.1_27940 and earlier, including VMB3010, VMB4000, VMB3500, VMB4500, and VMB5000.
What happens if CVE-2019-3950 is exploited?
If CVE-2019-3950 is exploited, an attacker can gain unauthorized root access to the device via an onboard serial interface.
Is there a standard procedure to verify if my device is affected by CVE-2019-3950?
To verify if your device is affected by CVE-2019-3950, check the firmware version against the known vulnerable versions listed in the vulnerability details.