PT-2018-13695 · Lg · Lg Supersign Cms

Ale Fanjul · Published 2018-09-14 · Updated 2020-08-24 · CVE-2018-16706

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LG SuperSign CMS (affected versions not specified)

Description The issue allows LG TVs to be rebooted remotely without authentication. This can be achieved by sending a direct HTTP request to the /qsr server/device/reboot API endpoint on port 9080.

Recommendations For LG SuperSign CMS, as a temporary workaround, consider restricting access to the /qsr server/device/reboot API endpoint on port 9080 until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2018-16706

Affected Products

Lg Supersign Cms

References · 3

• 🔥 https://github.com/Nurdilin/CVE-2018-16706 · Exploit
• 🔥 http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16706 · Security Note