PT-2019-16769 · Verizon · Verizon Fios Quantum Gateway

Published 2019-04-11 · Updated 2020-08-24 · CVE-2019-3914

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Verizon Fios Quantum Gateway (G1100) version 02.01.00.05

Description A remote command injection issue allows a remote, authenticated attacker to execute arbitrary commands on the target device. This can be achieved by adding an access control rule for a network object with a crafted hostname.

Recommendations For version 02.01.00.05, as a temporary workaround, consider restricting access to the network object configuration to minimize the risk of exploitation. Avoid using crafted hostnames in access control rules until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-3914

Affected Products

Verizon Fios Quantum Gateway

References · 3

• 🔥 https://tenable.com/security/research/tra-2019-17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3914 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3914 · Vendor Advisory