CVE-2019-3988: OS Command Injection

Q: What is CVE-2019-3988?

CVE-2019-3988 refers to a vulnerability in Blink XT2 Sync Module firmware prior to version 2.13.11 that allows remote attackers to execute arbitrary commands.

Q: How can an attacker exploit CVE-2019-3988?

An attacker can exploit CVE-2019-3988 by improperly sanitizing input when configuring the device's wifi configuration via the bssid parameter.

Q: What is the severity of CVE-2019-3988?

CVE-2019-3988 has a severity rating of 8.8 (high).

Q: What software is affected by CVE-2019-3988?

Blink XT2 Sync Module firmware prior to version 2.13.11 is affected by CVE-2019-3988.

Q: How can I fix CVE-2019-3988?

To fix CVE-2019-3988, users should update their Blink XT2 Sync Module firmware to version 2.13.11 or later.

Published Dec 11, 2019

Updated

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter.

Affected Software

2 affected components

Amazon Blink Xt2 Sync Module Firmware<2.13.11

Amazon Blink Xt2 Sync Module

Event History

Dec 11, 2019

CVE Published

via MITRE·10:39 PM

Data Sourced

via MITRE·10:39 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-3988?

CVE-2019-3988 refers to a vulnerability in Blink XT2 Sync Module firmware prior to version 2.13.11 that allows remote attackers to execute arbitrary commands.

How can an attacker exploit CVE-2019-3988?

An attacker can exploit CVE-2019-3988 by improperly sanitizing input when configuring the device's wifi configuration via the bssid parameter.

What is the severity of CVE-2019-3988?

CVE-2019-3988 has a severity rating of 8.8 (high).

What software is affected by CVE-2019-3988?

Blink XT2 Sync Module firmware prior to version 2.13.11 is affected by CVE-2019-3988.

How can I fix CVE-2019-3988?