CVE-2019-3984: OS Command Injection
Published Dec 31, 2019
·Updated
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.
Affected Software
2 affected components
Amazon Blink Xt2 Sync Module Firmware<2.3.11
Amazon Blink Xt2 Sync Module
Event History
Dec 31, 2019
CVE Published
via MITRE·05:45 PM
Data Sourced
via MITRE·05:45 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-3984.
2
What is the severity of CVE-2019-3984?
The severity of CVE-2019-3984 is critical, with a CVSS score of 9.8.
3
What is affected by CVE-2019-3984?
Blink XT2 Sync Module firmware prior to 2.13.11 is affected by CVE-2019-3984.
4
How can remote attackers exploit CVE-2019-3984?
Remote attackers can exploit CVE-2019-3984 by executing arbitrary commands on the device due to improperly sanitized input when the device retrieves update scripts from the internet.
5
Is Amazon Blink Xt2 Sync Module vulnerable to CVE-2019-3984?
No, Amazon Blink Xt2 Sync Module is not vulnerable to CVE-2019-3984.