CVE-2019-11417

moderate-risk
Published 2019-04-22

system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68.

Do I need to act?

-
0.46% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Tv-Ip110Wn Firmware
Tv-Ip110Wn Firmware
Tv-Ip110Wn Firmware
Tv-Ip110Wn Firmware

Affected Vendors

Trendnet

References (2)

Third Party Advisory https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png
Third Party Advisory https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png
44
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 10/34 · Low