PT-2019-12813 · Supra · Supra Smart Cloud Tv

Publicado 2019-06-04 · Atualizado 2019-06-11 · CVE-2019-12477

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Supra Smart Cloud TV (affected versions not specified)

Description The issue allows a local attacker to broadcast fake video without any authentication via the /remote/media control?action=setUri&uri= endpoint, specifically exploiting the openLiveURL function. This can be used to display fake content, such as emergency alerts, on the affected device.

Recommendations As a temporary workaround, consider disabling the openLiveURL function until a patch is available. Restrict access to the /remote/media control endpoint to minimize the risk of exploitation. Avoid using the uri parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-12477

Produtos afetados

Supra Smart Cloud Tv

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/supra_smart_cloud_tv_rfi.rb · Exploit
• 🔥 https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing · Exploit
• 🔥 https://exploit-db.com/exploits/46971 · Exploit
• 🔥 http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12477 · Nota de Segurança
• https://t.me/tmfeed/64389 · Publicação no Telegram
• https://t.me/opennews/5199 · Publicação no Telegram