CVE-2018-1151

Published: Jun 12, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.

Affected (2)

Products: Westerndigital: Tv Live Hub Firmware, Tv Media Player Firmware

Westerndigital

2 products

Tv Live Hub Firmware

Tv Media Player Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital Tv Live Hub Firmware	Version 3.12.13

Running on/with	Platform Versions
Westerndigital Tv Live Hub	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital Tv Media Player Firmware	Version 1.03.07

Running on/with	Platform Versions
Westerndigital Tv Media Player	All versions

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (2)

https://www.tenable.com/security/research/tra-2018-14

Source: vulnreport@tenable.com

ExploitThird Party Advisory

https://www.tenable.com/security/research/tra-2018-14

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.