PT-2018-13695 · Lg · Lg Supersign Cms

Ale Fanjul · Publicado 2018-09-14 · Atualizado 2020-08-24 · CVE-2018-16706

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LG SuperSign CMS (affected versions not specified)

Description The issue allows LG TVs to be rebooted remotely without authentication. This can be achieved by sending a direct HTTP request to the /qsr server/device/reboot API endpoint on port 9080.

Recommendations For LG SuperSign CMS, as a temporary workaround, consider restricting access to the /qsr server/device/reboot API endpoint on port 9080 until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2018-16706

Produtos afetados

Lg Supersign Cms

Referências · 3

• 🔥 https://github.com/Nurdilin/CVE-2018-16706 · Exploit
• 🔥 http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16706 · Nota de Segurança