PT-2019-12078 · Sony · Sony Photo Sharing Plus

Published 2019-04-19 · Updated 2020-08-24 · CVE-2019-10886

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sony Photo Sharing Plus application in the firmware before PKG6.5629 version

Description The issue is related to incorrect access control in the Sony Photo Sharing Plus application. This allows an attacker to read arbitrary files without authentication over HTTP when the application is running, potentially enabling them to browse specific directories, such as images, inside a private network.

Recommendations For versions before PKG6.5629, update the firmware to version PKG6.5629 or later to resolve the issue. As a temporary workaround, consider disabling the Photo Sharing Plus application until the update is applied. Restrict access to the application to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-10886

Affected Products

Sony Photo Sharing Plus

References · 8

• 🔥 https://seclists.org/bugtraq/2019/Apr/34 · Exploit
• 🔥 https://sony.com/electronics/support/downloads/00016043 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10886 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10886 · Vendor Advisory
• http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html · Note
• https://t.me/cybersecuritytechnologies/223 · Telegram Post
• http://securityfocus.com/bid/108072 · Note
• http://seclists.org/fulldisclosure/2019/Apr/32 · Note