PT-2019-12943 · Actiontec · Actiontec T2200H

Publicado 2019-06-12 · Atualizado 2020-08-24 · CVE-2019-12789

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Actiontec T2200H version T2200H-31.128L.08

Description An issue allows an attacker to gain root access by attaching a UART adapter to the system board and using a special key sequence, Ctrl-. After gaining root access, the attacker can make permanent modifications to the device, including bricking the device, disabling vendor management, preventing automatic upgrades, and installing malicious code.

Recommendations For Actiontec T2200H version T2200H-31.128L.08, consider restricting physical access to the device to prevent attachment of a UART adapter, as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2019-12789

Produtos afetados

Actiontec T2200H

Referências · 5

• 🔥 http://seclists.org/fulldisclosure/2019/Jun/10 · Exploit
• https://t.me/defcon_news/16190 · Publicação no Telegram
• https://actiontec.com/blog · Nota
• https://osv.dev/vulnerability/CVE-2019-12789 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12789 · Nota de Segurança