PT-2019-12238 · Motorola · Motorola M2+1

Published 2019-04-18 · Updated 2020-08-24 · CVE-2019-11322

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Motorola CX2 version 1.01 Motorola M2 version 1.01

Description An issue was discovered that leads to remote code execution via shell metacharacters in a JSON value. This is due to a command injection in the startRmtAssist function in hnap.

Recommendations For Motorola CX2 version 1.01, consider disabling the startRmtAssist function in hnap to prevent command injection until a patch is available. For Motorola M2 version 1.01, consider disabling the startRmtAssist function in hnap to prevent command injection until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-11322

Affected Products

Motorola Cx2

Motorola M2

References · 3

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11322 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11322 · Vendor Advisory