Sign-up

ID

VAR-202001-0278


CVE

CVE-2019-17094


TITLE

Belkin WeMo Insight Switch  Out of boundary write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2019-014441

DESCRIPTION

A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and prior versions. Belkin WeMo Insight Switch Firmware contains an out-of-bounds write vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state

Trust: 1.62

sources: NVD: CVE-2019-17094 // JVNDB: JVNDB-2019-014441

AFFECTED PRODUCTS

vendor:belkinmodel:wemo insight switchscope:ltversion:2.00.11396

Trust: 1.0

vendor:belkinmodel:wemo insight switchscope:eqversion: -

Trust: 0.8

vendor:belkinmodel:wemo insight switchscope:lteversion:wemo insight switch firmware 2.00.11396

Trust: 0.8

sources: JVNDB: JVNDB-2019-014441 // NVD: CVE-2019-17094

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-17094
value: HIGH

Trust: 1.0

cve-requests@bitdefender.com: CVE-2019-17094
value: HIGH

Trust: 1.0

NVD: CVE-2019-17094
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202001-1176
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2019-17094
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2019-17094
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cve-requests@bitdefender.com: CVE-2019-17094
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2019-17094
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2019-014441 // CNNVD: CNNVD-202001-1176 // NVD: CVE-2019-17094 // NVD: CVE-2019-17094

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds write (CWE-787) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2019-014441 // NVD: CVE-2019-17094

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202001-1176

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202001-1176

PATCH

title:Top Pageurl:https://www.belkin.com

Trust: 0.8

sources: JVNDB: JVNDB-2019-014441

EXTERNAL IDS

db:NVDid:CVE-2019-17094

Trust: 2.4

db:JVNDBid:JVNDB-2019-014441

Trust: 0.8

db:CNNVDid:CNNVD-202001-1176

Trust: 0.6

sources: JVNDB: JVNDB-2019-014441 // CNNVD: CNNVD-202001-1176 // NVD: CVE-2019-17094

REFERENCES

url:https://labs.bitdefender.com/2019/12/multiple-vulnerabilities-in-belkin-wemo-insight-switch/

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2019-17094

Trust: 1.4

sources: JVNDB: JVNDB-2019-014441 // CNNVD: CNNVD-202001-1176 // NVD: CVE-2019-17094

SOURCES

db:JVNDBid:JVNDB-2019-014441
db:CNNVDid:CNNVD-202001-1176
db:NVDid:CVE-2019-17094

LAST UPDATE DATE

2024-11-23T22:37:34.461000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2019-014441date:2020-02-18T00:00:00
db:CNNVDid:CNNVD-202001-1176date:2021-01-05T00:00:00
db:NVDid:CVE-2019-17094date:2024-11-21T04:31:40.820

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2019-014441date:2020-02-18T00:00:00
db:CNNVDid:CNNVD-202001-1176date:2020-01-27T00:00:00
db:NVDid:CVE-2019-17094date:2020-01-27T18:15:12.367