Vulnerability Details CVE-2018-19240
Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.031
EPSS Ranking 86.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Dec/21
- http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Dec/21
Products affected by CVE-2018-19240
-
cpe:2.3:h:trendnet:tv-ip110wn:-
-
cpe:2.3:h:trendnet:tv-ip121wn:-
-
cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.64
-
cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.65
-
cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.68
-
cpe:2.3:o:trendnet:tv-ip121wn_firmware:1.2.2.28