PT-2019-12813 · Supra · Supra Smart Cloud Tv

Published 2019-06-04 · Updated 2019-06-11 · CVE-2019-12477

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Supra Smart Cloud TV (affected versions not specified)

Description The issue allows a local attacker to broadcast fake video without any authentication via the /remote/media control?action=setUri&uri= endpoint, specifically exploiting the openLiveURL function. This can be used to display fake content, such as emergency alerts, on the affected device.

Recommendations As a temporary workaround, consider disabling the openLiveURL function until a patch is available. Restrict access to the /remote/media control endpoint to minimize the risk of exploitation. Avoid using the uri parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-12477

Affected Products

Supra Smart Cloud Tv

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/supra_smart_cloud_tv_rfi.rb · Exploit
• 🔥 https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing · Exploit
• 🔥 https://exploit-db.com/exploits/46971 · Exploit
• 🔥 http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12477 · Security Note
• https://t.me/tmfeed/64389 · Telegram Post
• https://t.me/opennews/5199 · Telegram Post