Vulnerability Details CVE-2019-12780
The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.394
EPSS Ranking 97.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
Products affected by CVE-2019-12780
-
cpe:2.3:h:belkin:crock-pot_smart_slow_cooker_with_wemo:-
-
cpe:2.3:o:belkin:crock-pot_smart_slow_cooker_with_wemo_firmware:-