Details of VAR-202001-0739

ID

VAR-202001-0739

CVE

CVE-2019-19495

TITLE

Technicolor TC7230 STEB Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-014187

DESCRIPTION

The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScript in a victim's browser. The attacker can then configure the cable modem to port forward the modem's internal TELNET server, allowing external access to a root shell. Technicolor TC7230 STEB Contains an input validation vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state

Trust: 1.62

sources: NVD: CVE-2019-19495 // JVNDB: JVNDB-2019-014187

AFFECTED PRODUCTS

vendor:	technicolor	model:	tc7230 steb	scope:	eq	version:	0.1.25	Trust: 1.0
vendor:	technicolor	model:	tc7230 steb	scope:	eq	version:	01.25	Trust: 0.8

sources: JVNDB: JVNDB-2019-014187 // NVD: CVE-2019-19495

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2019-19495
value:	CRITICAL
Trust: 1.8
CNNVD:	CNNVD-202001-260
value:	MEDIUM
Trust: 0.6

NVD:	CVE-2019-19495
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

NVD:	CVE-2019-19495
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-19495
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-014187 // CNNVD: CNNVD-202001-260 // NVD: CVE-2019-19495

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2019-014187 // NVD: CVE-2019-19495

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-260

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202001-260

CONFIGURATIONS

sources: NVD: CVE-2019-19495

PATCH

title:

Top Page

url:

https://www.technicolor.com/

Trust: 0.8

sources: JVNDB: JVNDB-2019-014187

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19495	Trust: 2.4
db:	JVNDB	id:	JVNDB-2019-014187	Trust: 0.8
db:	CNNVD	id:	CNNVD-202001-260	Trust: 0.6

sources: JVNDB: JVNDB-2019-014187 // CNNVD: CNNVD-202001-260 // NVD: CVE-2019-19495

REFERENCES

url:	https://github.com/lyrebirds/cable-haunt-report/releases/download/2.4/report.pdf	Trust: 2.4
url:	https://github.com/lyrebirds/fast8690-exploit	Trust: 1.6
url:	https://cablehaunt.com	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19495	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19495	Trust: 0.8

sources: JVNDB: JVNDB-2019-014187 // CNNVD: CNNVD-202001-260 // NVD: CVE-2019-19495

SOURCES

db:	JVNDB	id:	JVNDB-2019-014187
db:	CNNVD	id:	CNNVD-202001-260
db:	NVD	id:	CVE-2019-19495

LAST UPDATE DATE

2022-05-04T08:34:58.752000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-014187	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-260	date:	2020-04-22T00:00:00
db:	NVD	id:	CVE-2019-19495	date:	2020-01-22T16:10:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-014187	date:	2020-02-06T00:00:00
db:	CNNVD	id:	CNNVD-202001-260	date:	2020-01-08T00:00:00
db:	NVD	id:	CVE-2019-19495	date:	2020-01-08T18:15:00