CVE-2019-12477 : Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, w

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI.

Published 2019-06-07 15:29:01

Updated 2019-06-11 14:33:03

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversalFile inclusion

Products affected by CVE-2019-12477

Supra » Stv-lc40lt0020f Firmware » Version: N/A
cpe:2.3:o:supra:stv-lc40lt0020f_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Supra » Stv-lc40lt0020f » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-12477

EPSS FAQ

90.73%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-12477

Supra Smart Cloud TV Remote File Inclusion

Disclosure Date: 2019-06-03

First seen: 2020-04-26

auxiliary/admin/http/supra_smart_cloud_tv_rfi

This module exploits an unauthenticated remote file inclusion which exists in Supra Smart Cloud TV. The media control for the device doesn't have any session management or authentication. Leveraging this, an attacker on the local network can send a crafted re

More information

CVSS scores for CVE-2019-12477

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2019-12477

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12477

https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing

Video_PoC.mp4 - Google Drive
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html

Supra Smart Cloud TV Remote File Inclusion ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Jump to