Details of VAR-201912-1730

ID

VAR-201912-1730

CVE

CVE-2019-11399

TITLE

plural TRENDnet In product devices OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013378

DESCRIPTION

An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp lanHostCfg_HostName_1.1.1.0.0 parameter. TRENDnet TEW-651BR , TEW-652BRP , TEW-652BRU The device includes OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TRENDnet TEW-651BR and others are all wireless routers from TRENDnet. An operating system command injection vulnerability exists in TRENDnet TEW-651BR version 2.04B1, TEW-652BRP version 3.04b01, and TEW-652BRU version 1.00b12. The vulnerability originates from the process of externally inputting data to construct the executable command of the operating system, and the network system or product does not properly filter the special characters, commands, etc., and an attacker can use this vulnerability to execute illegal operating system commands

Trust: 2.25

sources: NVD: CVE-2019-11399 // JVNDB: JVNDB-2019-013378 // CNVD: CNVD-2020-01012 // VULMON: CVE-2019-11399

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-01012

AFFECTED PRODUCTS

vendor:	trendnet	model:	tew-651br	scope:	eq	version:	2.04b1	Trust: 1.8
vendor:	trendnet	model:	tew-652brp	scope:	eq	version:	3.04b01	Trust: 1.8
vendor:	trendnet	model:	tew-652bru	scope:	eq	version:	1.00b12	Trust: 1.8
vendor:	trendnet	model:	tew-651br 2.04b1	scope:	-	version:	-	Trust: 0.6
vendor:	trendnet	model:	tew-652brp 3.04b01	scope:	-	version:	-	Trust: 0.6
vendor:	trendnet	model:	tew-652bru 1.00b12	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-01012 // JVNDB: JVNDB-2019-013378 // NVD: CVE-2019-11399

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-11399
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-11399
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2020-01012
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201912-850
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2019-11399
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-11399
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-01012
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-11399
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-11399
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-01012 // VULMON: CVE-2019-11399 // JVNDB: JVNDB-2019-013378 // CNNVD: CNNVD-201912-850 // NVD: CVE-2019-11399

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2019-013378 // NVD: CVE-2019-11399

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201912-850

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201912-850

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013378

PATCH

title:	support	url:	https://www.trendnet.com/support/	Trust: 0.8
title:	FirmAE	url:	https://github.com/pr0v3rbs/FirmAE	Trust: 0.1
title:	-	url:	https://github.com/sinword/FirmAE_Connlab	Trust: 0.1

sources: VULMON: CVE-2019-11399 // JVNDB: JVNDB-2019-013378

EXTERNAL IDS

db:	NVD	id:	CVE-2019-11399	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-013378	Trust: 0.8
db:	CNVD	id:	CNVD-2020-01012	Trust: 0.6
db:	CNNVD	id:	CNNVD-201912-850	Trust: 0.6
db:	VULMON	id:	CVE-2019-11399	Trust: 0.1

sources: CNVD: CNVD-2020-01012 // VULMON: CVE-2019-11399 // JVNDB: JVNDB-2019-013378 // CNNVD: CNNVD-201912-850 // NVD: CVE-2019-11399

REFERENCES

url:	https://github.com/pr0v3rbs/cve/blob/master/cve-2019-11399/ticket.png	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-11399	Trust: 2.0
url:	https://www.trendnet.com/support/	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11399	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/78.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/pr0v3rbs/firmae	Trust: 0.1

sources: CNVD: CNVD-2020-01012 // VULMON: CVE-2019-11399 // JVNDB: JVNDB-2019-013378 // CNNVD: CNNVD-201912-850 // NVD: CVE-2019-11399

SOURCES

db:	CNVD	id:	CNVD-2020-01012
db:	VULMON	id:	CVE-2019-11399
db:	JVNDB	id:	JVNDB-2019-013378
db:	CNNVD	id:	CNNVD-201912-850
db:	NVD	id:	CVE-2019-11399

LAST UPDATE DATE

2024-11-23T22:11:40.838000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-01012	date:	2020-01-08T00:00:00
db:	VULMON	id:	CVE-2019-11399	date:	2019-12-23T00:00:00
db:	JVNDB	id:	JVNDB-2019-013378	date:	2019-12-27T00:00:00
db:	CNNVD	id:	CNNVD-201912-850	date:	2020-06-18T00:00:00
db:	NVD	id:	CVE-2019-11399	date:	2024-11-21T04:21:01.877

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-01012	date:	2020-01-08T00:00:00
db:	VULMON	id:	CVE-2019-11399	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013378	date:	2019-12-27T00:00:00
db:	CNNVD	id:	CNNVD-201912-850	date:	2019-12-18T00:00:00
db:	NVD	id:	CVE-2019-11399	date:	2019-12-18T15:15:10.803