CVE-2019-3986: OS Command Injection
First published: Wed Dec 11 2019(Updated: )
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Blink Xt2 Sync Module Firmware | <2.13.11 | |
| Amazon Blink Xt2 Sync Module |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-3986?
CVE-2019-3986 is a vulnerability in the Blink XT2 Sync Module firmware prior to version 2.13.11 that allows remote attackers to execute arbitrary commands on the device.
What is the severity of CVE-2019-3986?
The severity of CVE-2019-3986 is high, with a CVSS score of 8.8.
How can I exploit CVE-2019-3986?
As a cybersecurity analyst, I do not recommend or condone exploiting vulnerabilities. This question is inappropriate and unethical.
How do I fix CVE-2019-3986?
To fix CVE-2019-3986, update the Blink XT2 Sync Module firmware to version 2.13.11 or later.
Where can I find more information about CVE-2019-3986?
More information about CVE-2019-3986 can be found at the following link: https://www.tenable.com/security/research/tra-2019-51
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/tags
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- vendor/amazon
- canonical/amazon blink xt2 sync module firmware
- canonical/amazon blink xt2 sync module