PT-2019-9056 · Lg · Lg N1A1 Nas

Published 2019-05-14 · Updated 2025-01-23 · CVE-2018-14839

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LG N1A1 NAS version 3718.510

Description The issue allows for remote command execution, enabling the execution of arbitrary code. The attack vector involves an HTTP POST request with specific parameters.

Recommendations For LG N1A1 NAS version 3718.510, consider restricting access to the HTTP POST endpoint to minimize the risk of exploitation until a patch is available. Avoid using vulnerable parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-14839

Affected Products

Lg N1A1 Nas

References · 7

• 🔥 https://medium.com/%400x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247 · Exploit
• 🔥 https://exploit-db.com/exploits/45109 · Exploit
• 🔥 https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247 · Exploit
• https://osv.dev/vulnerability/CVE-2018-14839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14839 · Security Note
• https://t.me/cvenotify/108382 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14839 · Note