PT-2019-12943 · Actiontec · Actiontec T2200H

Published 2019-06-12 · Updated 2020-08-24 · CVE-2019-12789

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Actiontec T2200H version T2200H-31.128L.08

Description An issue allows an attacker to gain root access by attaching a UART adapter to the system board and using a special key sequence, Ctrl-. After gaining root access, the attacker can make permanent modifications to the device, including bricking the device, disabling vendor management, preventing automatic upgrades, and installing malicious code.

Recommendations For Actiontec T2200H version T2200H-31.128L.08, consider restricting physical access to the device to prevent attachment of a UART adapter, as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-12789

Affected Products

Actiontec T2200H

References · 5

• 🔥 http://seclists.org/fulldisclosure/2019/Jun/10 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12789 · Security Note
• https://t.me/defcon_news/16190 · Telegram Post
• https://actiontec.com/blog · Note