CVE-2019-12780

2019-06-1015:46:05

mitre

www.cve.org

AI Score

9.9

Confidence

High

EPSS

0.729

Percentile

98.1%

JSON

The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.

References

www.exploit-db.com/exploits/46436