CVE-2019-3988: OS Command Injection
First published: Wed Dec 11 2019(Updated: )
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Blink Xt2 Sync Module Firmware | <2.13.11 | |
| Amazon Blink Xt2 Sync Module |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-3988?
CVE-2019-3988 refers to a vulnerability in Blink XT2 Sync Module firmware prior to version 2.13.11 that allows remote attackers to execute arbitrary commands.
How can an attacker exploit CVE-2019-3988?
An attacker can exploit CVE-2019-3988 by improperly sanitizing input when configuring the device's wifi configuration via the bssid parameter.
What is the severity of CVE-2019-3988?
CVE-2019-3988 has a severity rating of 8.8 (high).
What software is affected by CVE-2019-3988?
Blink XT2 Sync Module firmware prior to version 2.13.11 is affected by CVE-2019-3988.
How can I fix CVE-2019-3988?
To fix CVE-2019-3988, users should update their Blink XT2 Sync Module firmware to version 2.13.11 or later.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/amazon
- canonical/amazon blink xt2 sync module firmware
- canonical/amazon blink xt2 sync module