Lucene search

TenableCVE-2018-1151

HistoryJun 12, 2018 - 5:29 p.m.

CVE-2018-1151

2018-06-1217:29:00

CWE-119

tenable

web.nvd.nist.gov

cve-2018-115

web server

western digital

tv media player

tv live hub

unauthenticated

remote attackers

arbitrary code

denial of service

http requests

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.011

Percentile

84.7%

JSON

The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.

Affected configurations

Nvd

Node

westerndigitaltv_live_hub_firmwareMatch3.12.13

AND

westerndigitaltv_live_hubMatch-

Node

westerndigitaltv_media_player_firmwareMatch1.03.07

AND

westerndigitaltv_media_playerMatch-

VendorProductVersionCPE
westerndigitaltv_live_hub_firmware3.12.13cpe:2.3:o:westerndigital:tv_live_hub_firmware:3.12.13:*:*:*:*:*:*:*
westerndigitaltv_live_hub-cpe:2.3:h:westerndigital:tv_live_hub:-:*:*:*:*:*:*:*
westerndigitaltv_media_player_firmware1.03.07cpe:2.3:o:westerndigital:tv_media_player_firmware:1.03.07:*:*:*:*:*:*:*
westerndigitaltv_media_player-cpe:2.3:h:westerndigital:tv_media_player:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
westerndigital	tv_live_hub_firmware	3.12.13	cpe:2.3:o:westerndigital:tv_live_hub_firmware:3.12.13:::::::*
westerndigital	tv_live_hub	-	cpe:2.3:h:westerndigital:tv_live_hub:-:::::::*
westerndigital	tv_media_player_firmware	1.03.07	cpe:2.3:o:westerndigital:tv_media_player_firmware:1.03.07:::::::*
westerndigital	tv_media_player	-	cpe:2.3:h:westerndigital:tv_media_player:-:::::::*

CNA Affected

[
  {
    "product": "TV Media Player",
    "vendor": "Western Digital",
    "versions": [
      {
        "status": "affected",
        "version": "1.03.07"
      }
    ]
  },
  {
    "product": "TV Live Hub",
    "vendor": "Western Digital",
    "versions": [
      {
        "status": "affected",
        "version": "3.12.13"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2018-14

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.011

Percentile

84.7%

JSON

Related for CVE-2018-1151